https://systechitsolutions.co.uk/_next/static/chunks/pages/blog/ke…er-configuration-checks-c03c4a3a6fe7d572.js

1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[7058],{85857:function(e,a,t){(window.__NEXT_P=window.__NEXT_P||[]).push(["/blog/kemp-loadmaster-configuration-checks",function(){return t(43176)}])},43176:function(e,a,t){"use strict";t.r(a),t.d(a,{default:function(){return p},faqs:function(){return l},meta:function(){return h}});var s=t(85893),r=t(11151),i=t(50148),n=t(86256),o=t(59569),c={pain:{id:"pain",section:"Why look at a load balancer that works?",kind:"vignette",alt:"Illustration of a LoadMaster that looks healthy: traffic forwards correctly, but the standby unit has never been failed over, a certificate is nearing expiry and the configuration backup has never been restored.",caption:"None of this shows up while the load balancer works. Each one surfaces on the day it is needed.",wide:{src:"/_next/static/media/blog-kemp-loadmaster-configuration-checks-pain.19c14bf5.webp",height:1038,width:1760,blurDataURL:"data:image/webp;base64,UklGRiwAAABXRUJQVlA4ICAAAABQAQCdASoIAAUAAkA4JZwABDOAAP754QjAFmbilBAAAA==",blurWidth:8,blurHeight:5},narrow:{src:"/_next/static/media/blog-kemp-loadmaster-configuration-checks-pain-narrow.29bdc2e9.webp",height:1400,width:1e3,blurDataURL:"data:image/webp;base64,UklGRi4AAABXRUJQVlA4ICIAAACwAQCdASoGAAgAAkA4JZwAAudZOcYAAP79eXsh4v3uCAAA",blurWidth:6,blurHeight:8}},ha:{id:"ha",section:"2. High availability",kind:"diagram",alt:"Diagram: traffic arrives on a shared IP address held by the active unit of a LoadMaster HA pair, with the standby ready to take over, and goes on to the real servers that pass their health checks.",caption:"Both units share one IP address. If their modes, certificates or settings differ, the failover is the first thing to break.",wide:{src:"/_next/static/media/blog-kemp-loadmaster-configuration-checks-ha.0b181603.webp",height:1158,width:1760,blurDataURL:"data:image/webp;base64,UklGRigAAABXRUJQVlA4IBwAAABQAQCdASoIAAUAAkA4JZwABDOAAP75s5dxSggA",blurWidth:8,blurHeight:5},narrow:{src:"/_next/static/media/blog-kemp-loadmaster-configuration-checks-ha-narrow.29e35c5d.webp",height:1486,width:1e3,blurDataURL:"data:image/webp;base64,UklGRigAAABXRUJQVlA4IBwAAABQAQCdASoFAAgAAkA4JZwABDOAAP753QNO7AAA",blurWidth:5,blurHeight:8}}};let h=(0,n.zQ)("kemp-loadmaster-configuration-checks"),l=[{q:"How often should a Kemp LoadMaster be checked?",a:"Progress Kemp does not set a review interval, so the sensible trigger is change. Check it after any firmware update, before a licence renewal, when the person who built it leaves, and whenever an application behind it changes. Certificates need their own calendar, because an expiry does not wait for a review. Between reviews, remote syslog and email alerts are what tell you something has changed."},{q:"Is a configuration backup enough to restore a LoadMaster?",a:"Not on its own. Progress Kemp's documentation states that no SSL certificate information is contained within a configuration backup, so certificates need a separate certificate backup. It also says hypervisor snapshots cannot be used to restore a LoadMaster to a working state, and that a restore of the base configuration has to go to a unit in the same high availability mode as the one the backup came from."},{q:"What does the health check need from us?",a:"A native configuration backup and the system, warning, boot and audit logs from the LoadMaster. For a high availability pair, a backup and logs from each node so the two can be compared. Certificate exports are optional, for a deeper certificate review. Nothing connects to or changes the appliance."},{q:"Is the LoadMaster health check a Progress Kemp service?",a:"No. Systech is a Progress Kemp partner, and the health check is our own fixed-price service. It checks the appliance against Progress Kemp's published guidance, and anything that needs Progress support, such as a licence or entitlement question, still goes through Progress."}],d=function(e){let{children:a}=e;return(0,s.jsx)(i.Bf,{slug:h.slug,title:h.title,seoTitle:h.seoTitle,seoDescription:h.seoDescription,category:h.category,excerpt:h.excerpt,publishedAt:h.publishedAt,updatedAt:h.updatedAt,readTime:h.readTime,heroImage:h.heroImage,faqs:l,ctaOffer:"kempHealthCheck",children:a})};function g(e){let a={a:"a",details:"details",h2:"h2",li:"li",nav:"nav",ol:"ol",p:"p",strong:"strong",summary:"summary",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:["\n","\n","\n",(0,s.jsx)("p",{className:"lede",children:"A LoadMaster that has run quietly for years is not necessarily a healthy one. It may simply be one nobody has looked at. These are the configuration areas worth checking, and what Progress Kemp's own documentation says good looks like in each."}),"\n",(0,s.jsxs)("p",{className:"answer",children:[(0,s.jsx)("strong",{children:"In short:"})," a LoadMaster health check looks at seven areas: firmware and lifecycle, high availability, certificates, real server health checking, logging, configuration backups and administrative access. Progress Kemp publishes the standard for most of them, including a hardening technical note. The checks that matter most are the ones that only fail on a bad day: a failover that does not fail over, a certificate that expires, or a backup that cannot be restored."]}),"\n",(0,s.jsx)(a.nav,{className:"pageNav pageNav--inline","aria-label":"On this page",children:(0,s.jsxs)(a.details,{className:"pageNav__details",children:[(0,s.jsx)(a.summary,{className:"pageNav__title",children:"On this page"}),(0,s.jsxs)(a.ol,{className:"pageNav__list",children:[(0,s.jsx)(a.li,{children:(0,s.jsx)(a.a,{className:"pageNav__link",href:"#why-look-at-a-load-balancer-that-works",children:"Why look at a load balancer that works?"})}),(0,s.jsx)(a.li,{children:(0,s.jsx)(a.a,{className:"pageNav__link",href:"#1-firmware-and-lifecycle",children:"1. Firmware and lifecycle"})}),(0,s.jsx)(a.li,{children:(0,s.jsx)(a.a,{className:"pageNav__link",href:"#2-high-availability",children:"2. High availability"})}),(0,s.jsx)(a.li,{children:(0,s.jsx)(a.a,{className:"pageNav__link",href:"#3-certificates",children:"3. Certificates"})}),(0,s.jsx)(a.li,{children:(0,s.jsx)(a.a,{className:"pageNav__link",href:"#4-real-server-health-checking",children:"4. Real server health checking"})}),(0,s.jsx)(a.li,{children:(0,s.jsx)(a.a,{className:"pageNav__link",href:"#5-logging-and-time",children:"5. Logging and time"})}),(0,s.jsx)(a.li,{children:(0,s.jsx)(a.a,{className:"pageNav__link",href:"#6-configuration-backups",children:"6. Configuration backups"})}),(0,s.jsx)(a.li,{children:(0,s.jsx)(a.a,{className:"pageNav__link",href:"#7-administrative-access",children:"7. Administrative access"})}),(0,s.jsx)(a.li,{children:(0,s.jsx)(a.a,{className:"pageNav__link",href:"#what-the-health-check-report-looks-like",children:"What the health check report looks like"})}),(0,s.jsx)(a.li,{children:(0,s.jsx)(a.a,{className:"pageNav__link",href:"#where-to-start",children:"Where to start"})})]})]})}),(0,s.jsx)(a.h2,{id:"why-look-at-a-load-balancer-that-works",children:"Why look at a load balancer that works?"}),"\n",(0,s.jsx)(a.p,{children:"Because the failures that matter do not show up while it works. A load balancer forwards traffic correctly right up until the moment the standby unit is needed, a certificate reaches its expiry date, or somebody tries to restore it."}),"\n",(0,s.jsx)(o.d,{figure:c.pain}),"\n",(0,s.jsxs)(a.p,{children:["The ",(0,s.jsx)(a.a,{href:"/partnerships/kemp",children:"Kemp partner page"})," covers the lifecycle side: model end-of-life dates, MELA licensing and what changed when Progress acquired Kemp. This post covers the configuration itself."]}),"\n",(0,s.jsx)(a.h2,{id:"1-firmware-and-lifecycle",children:"1. Firmware and lifecycle"}),"\n",(0,s.jsxs)(a.p,{children:["Progress Kemp's ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-technical-note-loadmaster-hardening-ga/page/General-Guidance.html",children:"hardening note"})," strongly recommends running at least the latest Long Term Support Feature (LTSF) firmware, because that is where the latest security fixes are. It also recommends signing up to the Progress Alert and Notifications Service."]}),"\n",(0,s.jsx)(a.p,{children:"What to check:"}),"\n",(0,s.jsxs)(a.ul,{children:["\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"The running firmware version"}),", against the current LTSF release."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Whether anyone receives Progress security alerts."})," If the address on file belongs to someone who has left, nobody does."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Update verification."})," By default the ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-configuration-guide-web-user-interface-wui-ga/page/Update-Software.html",children:"update screen"})," verifies the integrity of a patch at install time, with an optional signed XML verification file."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"The upgrade path for your hardware."})," Progress Kemp notes that the NG hardware models introduced in 2023 use UEFI boot and need UEFI-capable patches, so not every image installs on every appliance."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Where the model sits in its support life."})," Kemp's policy is five years of support after End of Sale. The table on our ",(0,s.jsx)(a.a,{href:"/partnerships/kemp",children:"Kemp page"})," does that sum for each model."]}),"\n"]}),"\n",(0,s.jsx)(a.h2,{id:"2-high-availability",children:"2. High availability"}),"\n",(0,s.jsxs)(a.p,{children:["A high availability (HA) pair is two identical LoadMasters, one active and one on standby, sharing an IP address. Progress Kemp's ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-feature-description-high-availability-ha-ga/page/Introduction.html",children:"HA feature description"})," says a shared IP address must be added to every production interface."]}),"\n",(0,s.jsx)(o.d,{figure:c.ha}),"\n",(0,s.jsx)(a.p,{children:"What to check:"}),"\n",(0,s.jsxs)(a.ul,{children:["\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Distinct HA modes."})," One unit must be HA (First) Mode and the other HA (Second) Mode. The ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-feature-description-high-availability-ha-ga/page/HA-Parameters.html",children:"HA parameters page"})," warns that both in the same mode means both units go active and try to use the same IP address."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Status icons."})," Both should be green, with an A on the active unit. Red or yellow means the partner is unreachable and not ready to take over. Blue means a unit has rebooted more than three times in five minutes and is pacified, so it will not take over at all."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Both nodes compared."})," Settings that differ between the two units are a failover problem waiting to happen."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Local certificates."})," On failover the shared IP inherits the local certificate of the unit that becomes active, so both units need the same one."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"The bal password."})," The hardening note says to set it identically on both units to prevent lockouts after failover."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"A partner shared secret"}),", set for HA, clustering or GEO partners."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"When failover was last tested."})," Progress Kemp's ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-feature-description-high-availability-ha-ga/page/Test-Failover.html",children:"suggested test"})," is to reboot the active unit and confirm the other one takes over."]}),"\n"]}),"\n",(0,s.jsx)(i.NT,{children:"A standby unit nobody has tested is an assumption, not a failover plan."}),"\n",(0,s.jsx)(a.h2,{id:"3-certificates",children:"3. Certificates"}),"\n",(0,s.jsx)(a.p,{children:"Certificate problems are the most visible failure a load balancer has, because users see the browser warning before anyone sees a log."}),"\n",(0,s.jsx)(a.p,{children:"What to check:"}),"\n",(0,s.jsxs)(a.ul,{children:["\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Expiry dates"})," for every certificate on the ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-configuration-guide-web-user-interface-wui-ga/page/SSL-Certificates.html",children:"SSL certificates screen"}),", and who owns each renewal."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Intermediate certificates."})," The LoadMaster has a separate Add Intermediate option. A site certificate without its chain can work in one browser and fail in another."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Automated certificates."})," Let's Encrypt and DigiCert certificates are managed from the ACME certificates screen rather than the main one, so check renew

1al is actually configured there."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Key size."})," Progress Kemp notes that larger keys reduce SSL transactions per second non-linearly, so a 4096-bit key costs real performance compared with 2048-bit."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Re-encryption."})," Where traffic is re-encrypted to the servers, the hardening note recommends enabling Force Real Server Certificate Checking, so the LoadMaster verifies the server certificate, its chain and its expiry."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"The administrative certificate"}),", so the management interface is not still on the default one."]}),"\n"]}),"\n",(0,s.jsx)(a.h2,{id:"4-real-server-health-checking",children:"4. Real server health checking"}),"\n",(0,s.jsxs)(a.p,{children:["The LoadMaster only sends traffic to servers it believes are healthy, so the health check is what decides who gets traffic. The ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-configuration-guide-web-user-interface-wui-ga/page/Real-Servers.html",children:"real server settings"})," offer service checks such as HTTP, HTTPS, SMTP, LDAP and DNS, lower level TCP and ICMP checks, and None."]}),"\n",(0,s.jsx)(a.p,{children:"What to check:"}),"\n",(0,s.jsxs)(a.ul,{children:["\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"The check method fits the application."})," Progress Kemp describes a TCP check as simply a connect attempt. That proves the port is listening, not that the application behind it is working."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"No virtual services on None."})," With no checking, a failed server keeps receiving traffic."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Timers."})," The ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-configuration-guide-web-user-interface-wui-ga/page/Service-Health-Check-Parameters.html",children:"global defaults"})," are a 9-second interval, a 4-second timeout and 2 retries. Since firmware 7.2.52 these can be set per virtual service, so check for overrides that nobody remembers."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Minimum servers."})," With Enhanced Options off, which is the default, a virtual service counts as up if one real server is available. You can require more, and a server marked Critical takes the whole service down when it fails."]}),"\n"]}),"\n",(0,s.jsx)(a.h2,{id:"5-logging-and-time",children:"5. Logging and time"}),"\n",(0,s.jsxs)(a.p,{children:["A LoadMaster only keeps so much locally. The ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-technical-note-loadmaster-hardening-ga/page/Configure-Syslog-Hosts.html",children:"hardening note"})," says remote syslog is important for persistent log storage and for feeding a security event and incident management system."]}),"\n",(0,s.jsx)(a.p,{children:"What to check:"}),"\n",(0,s.jsxs)(a.ul,{children:["\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"A remote syslog host is configured"}),", at the severity levels you care about. The LoadMaster defines six, from Emergency to Info, and a failover appears as Critical."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"The transport."})," UDP, TCP or TLS can be configured. With TLS, the LoadMaster can check the syslog server's certificate using OCSP, and Server Certificate Validation is off by default."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"NTP is set."})," Logs with the wrong time are hard to correlate with anything else. The hardening note covers ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-technical-note-loadmaster-hardening-ga/page/Enable-an-NTP-Service.html",children:"authenticated NTP"}),"."]}),"\n"]}),"\n",(0,s.jsx)(a.h2,{id:"6-configuration-backups",children:"6. Configuration backups"}),"\n",(0,s.jsx)(a.p,{children:"What to check:"}),"\n",(0,s.jsxs)(a.ul,{children:["\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Backups use the native facility."})," Progress Kemp's ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-installation-guide-loadmaster-for-aws-ga/page/Best-Practices-for-Backups.html",children:"backup guidance"})," states that hypervisor snapshots cannot be used to restore a LoadMaster to a working state."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Backups are automated."})," Daily or weekly backups can go to a remote server over FTP, the default, or SCP."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Certificates are backed up separately."})," The ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-product-overview-progress-kemp-loadmaster-ltsf/page/Backup-and-Restore.html",children:"backup and restore overview"})," says no SSL certificate information is contained within a configuration backup."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"The restore target is known."})," A base configuration restores to a unit in the same HA mode as the one it came from, single to single or HA to HA."]}),"\n"]}),"\n",(0,s.jsx)(a.h2,{id:"7-administrative-access",children:"7. Administrative access"}),"\n",(0,s.jsxs)(a.p,{children:["Most of this section of the ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-technical-note-loadmaster-hardening-ga/page/Configure-Remote-Access.html",children:"hardening note"})," is about keeping management traffic away from production traffic."]}),"\n",(0,s.jsx)(a.p,{children:"What to check:"}),"\n",(0,s.jsxs)(a.ul,{children:["\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"A dedicated management interface."})," Progress Kemp's best practice is to use the first interface, such as eth0, for management traffic only."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Remote access settings."})," The note recommends disabling remote SSH access, keeping Allow Multi Interface Access off, and disabling the API interface. If monitoring or automation relies on the API, that is a decision to record rather than an accident to leave."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Management protocols."})," SSLv3, TLS 1.0 and TLS 1.1 should not be selected, and the cipher set should be Best Practices."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Named accounts."})," The default bal user should be treated as an emergency account, with ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-technical-note-loadmaster-hardening-ga/page/User-Accounts.html",children:"local user accounts"})," for day-to-day work."]}),"\n",(0,s.jsxs)(a.li,{children:[(0,s.jsx)(a.strong,{children:"Session management."})," The note recommends leaving failed login attempts at 3 and setting an idle timeout to your own policy."]}),"\n"]}),"\n",(0,s.jsx)(a.h2,{id:"what-the-health-check-report-looks-like",children:"What the health check report looks like"}),"\n",(0,s.jsxs)(a.table,{children:[(0,s.jsx)(a.thead,{children:(0,s.jsxs)(a.tr,{children:[(0,s.jsx)(a.th,{children:"Area"}),(0,s.jsx)(a.th,{children:"Typical question"}),(0,s.jsx)(a.th,{children:"Evidence used"})]})}),(0,s.jsxs)(a.tbody,{children:[(0,s.jsxs)(a.tr,{children:[(0,s.jsx)(a.td,{children:"Firmware and lifecycle"}),(0,s.jsx)(a.td,{children:"Is it on a supported LTSF release and model?"}),(0,s.jsx)(a.td,{children:"Version, model, support status"})]}),(0,s.jsxs)(a.tr,{children:[(0,s.jsx)(a.td,{children:"High availability"}),(0,s.jsx)(a.td,{children:"Would the standby take over, with the same settings?"}),(0,s.jsx)(a.td,{children:"Both node backups compared"})]}),(0,s.jsxs)(a.tr,{children:[(0,s.jsx)(a.td,{children:"Certificates"}),(0,s.jsx)(a.td,{children:"What expires, and is the chain complete?"}),(0,s.jsx)(a.td,{children:"Certificate list or exports"})]}),(0,s.jsxs)(a.tr,{children:[(0,s.jsx)(a.td,{children:"Health checking"}),(0,s.jsx)(a.td,{children:"Does each check prove the application works?"}),(0,s.jsx)(a.td,{children:"Virtual service configuration"})]}),(0,s.jsxs)(a.tr,{children:[(0,s.jsx)(a.td,{children:"Logging"}),(0,s.jsx)(a.td,{children:"Would you know if it failed over last night?"}),(0,s.jsx)(a.td,{children:"Syslog and NTP settings, logs"})]}),(0,s.jsxs)(a.tr,{children:[(0,s.jsx)(a.td,{children:"Backups"}),(0,s.jsx)(a.td,{children:"Could you rebuild it from what you hold?"}),(0,s.jsx)(a.td,{children:"Backup settings and history"})]}),(0,s.jsxs)(a.tr,{children:[(0,s.jsx)(a.td,{children:"Admin access"}),(0,s.jsx)(a.td,{children:"Who can manage it, and from where?"}),(0,s.jsx)(a.td,{children:"Access, user and session settings"})]})]})]}),"\n",(0,s.jsx)(a.p,{children:"Each finding is rated red, amber or green with the evidence behind it. Anything we could not check is listed as outstanding, because an item nobody checked is not a pass."}),"\n",(0,s.jsx)(a.h2,{id:"where-to-start",children:"Where to start"}),"\n",(0,s.jsxs)(a.p,{children:["You can work through the seven areas yourself using the links above. If you would rather have someone else do it, our ",(0,s.jsx)(a.a,{href:"/book/kemp-loadmaster-health-check",children:"LoadM

1aster health check"})," is a fixed-price review of your configuration backup and logs. It is read-only: we work from exported files, and nothing connects to or changes the appliance."]}),"\n",(0,s.jsx)(a.p,{children:"Systech is a Progress Kemp partner. The health check is our own service, not an official Progress Kemp one, and it is measured against the vendor guidance cited here."}),"\n",(0,s.jsxs)(a.p,{children:["Sources, checked 2 October 2026: ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-technical-note-loadmaster-hardening-ga/page/Introduction.html",children:"LoadMaster hardening technical note"}),", ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-feature-description-high-availability-ha-ga/page/Introduction.html",children:"High availability feature description"}),", ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-configuration-guide-web-user-interface-wui-ga/page/Real-Servers.html",children:"Real servers"}),", ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-configuration-guide-web-user-interface-wui-ga/page/Service-Health-Check-Parameters.html",children:"Service health check parameters"}),", ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-configuration-guide-web-user-interface-wui-ga/page/SSL-Certificates.html",children:"SSL certificates"}),", ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-configuration-guide-web-user-interface-wui-ga/page/Update-Software.html",children:"Update software"}),", ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-product-overview-progress-kemp-loadmaster-ltsf/page/Backup-and-Restore.html",children:"Backup and restore"})," and ",(0,s.jsx)(a.a,{href:"https://docs.progress.com/bundle/loadmaster-installation-guide-loadmaster-for-aws-ga/page/Best-Practices-for-Backups.html",children:"Best practices for backups"}),"."]})]})}function p(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};return(0,s.jsx)(d,{...e,children:(0,s.jsx)(g,{...e})})}}},function(e){e.O(0,[9707,2728,738,3796,7829,9396,8077,6379,9774,2888,179],function(){return e(e.s=85857)}),_N_E=e.O()}]);