We had defined software services which included the virtual server in F5, and software services which included the web servers. These 2 software services represent the different tiers for the same application. When the operation counts for both were reported, F5 Tier has much lesser count than the Web Tier. This does not looks right as I would expect the total for both to be the same. Any suggestion why are the numbers so different?
We noticed AMD is reporting there are high duplicated traffic. Our Network team is asking us which are the IPs. How do we retrieve such info?
I have had the same issue for a couple of applications. Make sure both software services have the same setting under the URL Auto-Learning tab and the Content Type tab, different settings on these tabs can alter the operation count. Then run a DMI report to compare the individual operations (URLs) at the F5 vs the web tier? Determine if each operation differs by the same amount or if a certain operation or operation type is more impacted.
Sometimes load balancers are configured to 'ping' the web servers in the pool. This can take the form of hitting an actual page (home.html, blank.html, healthcheck.html, etc), or a port ping. Accessing a page or pinging the port count as an operations - as it is a call to the server.
Look for operations (URLS) that appear on the Web Servers, but not the load balancers (F5). If it's a port ping - you may want to check with your LB admin to see how they determine the members in the pool, and how often they may be pinging the web server port. It may correlate to the extra operation count.