[NetScaler] Graceful disable service may trigger TCP RESET immediately

[NetScaler] Graceful disable service may trigger TCP RESET immediately

book

Article ID: CTX492010

calendar_today

Updated On:

Description

According to eDoc: Graceful shutdown of services. If we disable an HTTP service with the following command: 

> disable service HTTP_Svc_Name 0 -graceFul YES
We expect to see all ESTABLISHED connections alive. But in real cases, we may see partial connections got TCP RST from NetScaler ADC immediately.  RST code is 9300. 
  • 9300 - NSBE_DBG_RST_ZSSSR

Resolution

To change the behavior, we can disable connection multiplexing in HTTP type vServer. 

1. Disable connection multiplexing in the according HTTP profile. By default, it's nshttp_default_profile. 

set ns httpProfile HTTP_Profile_Name -conMultiplex DISABLED

2. Waiting for at least IDLE timeout (By default 180 seconds) + Zombie timeout (By default 120 seconds). 
Note: The change in step 1 will take effect only when next HTTP request comes in to make IDLE connection ACTIVE again in an HTTP type vServer. And for new connections, it'll take effect immediately. That's why we need to wait for the timeout.

3. Disable the service with graceful enabled. 

> disable service HTTP_Svc_Name 0 -graceFul YES

Problem Cause

The issue only happens in HTTP type vServers. All of the disconnected connections are in IDLE state, which is by design when multiplexing is enabled (by default). Connections have ACTIVE transactions won't be disconnected. 
With Multiplexing, TCP connections will be INACTIVE in IDLE state because frontend and backend connections are de-linked when HTTP transaction is finished. Graceful disable only takes care of ACTIVE connections. 

TCP type vServer won't have this issue because IDLE connections in TCP type vServer are still ACTIVE. 
For more information about mulplexing, please refer to: Connection Multiplexing in NetScaler.