RTFM · Healthchecks

lb.saphira.multiport: all doors, or none

Appliances rarely expose one port. A storage array wants SSH, HTTPS and its API; a mail host wants three. multiport knocks on every door and only passes when the ones you named have all answered, or, in any mode, when at least one has.

What it proves

Layer 4 across a port list: a compound TCP reachability verdict. In the default all mode every listed port must accept a connection; the honest check for "the appliance is up" where a service listening on one port of five proves nothing. In any mode, one success suffices; useful for hosts where several alternative entry points are acceptable.

How it works

The port list comes from the caller ABI ($4) or from LB_SAPHIRA_MULTIPORT_PORTS; space, comma or colon separated. Each port is probed with saphira-lb-probe tcp, and the results are combined per the mode. Ports are probed in sequence within the shared timeout budget.

Configuration

Knobs
Variable	Default	Meaning
LB_SAPHIRA_MULTIPORT_PORTS	$4	Port list: "443 8443", "22,80,443" or "53:5353"
LB_SAPHIRA_MULTIPORT_MODE	all	all = every port must pass; any = at least one
LB_SAPHIRA_TIMEOUT	3	Per-port connect timeout

Under ldirectord, $4 is a single real port; put the real list in LB_SAPHIRA_MULTIPORT_PORTS (env or conf file). Under HAProxy external-check the same applies; the ABI port remains the fallback when the variable is unset.

Wiring it up

ldirectord

# /etc/ha.d/ldirectord.cf
virtual = 203.0.113.10:443
    protocol = tcp
    scheduler = wlc
    real = 192.168.20.31:0 gate 1
    checktype = external
    checkcommand = "/var/lib/lb/saphira/lb.saphira.multiport"
# and in the conf layer:
#   /etc/saphira/lb-healthchecks.d/multiport.conf
#   LB_SAPHIRA_MULTIPORT_PORTS=22,443,8080

HAProxy

# haproxy.cfg
global
    external-check

backend app_pool
    mode tcp
    option external-check
    external-check command "/var/lib/lb/saphira/lb.saphira.multiport"
    server app1 192.168.20.31:443 check inter 5s fall 3 rise 2

Run it by hand

Manual run

LB_SAPHIRA_MULTIPORT_PORTS='22,443,8080' \
  /var/lib/lb/saphira/lb.saphira.multiport array-pool 443 192.168.20.31 443
echo $?
# 0 = all three ports accepted
# 1 = at least one failed (all mode) or all failed (any mode)
# 2 = empty port list

Failure modes

One port of many failed (all mode); the classic appliance case: web UI alive, service port dead, host otherwise fine. Exactly the failure a single-port check hides.
exit 2: no ports resolved from $4 or the variable

Did we miss something?

If this page left something unanswered, found an error, or there is another subject you would like documented, tell us. Saphira’s documentation grows from real problems people need to solve.

Send feedback or request a new section →

Prefer not to do it yourself?

Everything needed to do the work yourself is documented here and remains free; we charge for human time, not for withholding knowledge. Sometimes the missing resource is simply time. The same people who build Saphira can provide paid professional help with implementation, migration, troubleshooting and administration.

Ask about professional support →