Alert.conf file

This article might help you decipher SNMP traps a bit, or at least start you down that path: https://support.f5.com/kb/en-us/solutions/public/3000/700/sol3727.html

I need like a reference sheet that states what each snmp line does and what its alerting on?

Like:

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.11"; email toaddress="myemail@domain.com" fromaddress="root" body="Pool Member status is UP"

What is MCPD and how is this snmp trap difference compared to:

alert BIGIP_GTMD_POOL_SNMP_STATUS_CHANGE_X "SNMP_TRAP: Pool .? state change .? --> green" { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.40"

The alerts are generated based on events logged by syslog-ng. These two articles will somewhat clarify the alert meanings:

I am getting very uneasy results with this. The alerts do not stop when configured. UP/DOWN emails continuously even after the pool members have been brought back online. here is the config:

/* * from bigd (CR36393) -- changed from mcpd messages in v9.2.0 (CR46190) and hotfix v9.0.5 * For the following 4 alerts, messages need to be used in pattern match to * distiguish different ipaddr, port, etc. So, if these messages are changed, * the changes in alert system need to be done accordingly.

alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.12"; email toaddress="email@domain.com" fromaddress="root" body="Node status is DOWN" } alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS_UP { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.13"; email toaddress="email@domain.com" fromaddress="root" body="Node status is UP"

What is the frequency of the up/down email alerts? Did this start after modifying alert.conf? Do you get snmp traps or just the emails? Are there log messages in /var/log/ltm that correspond to the emails you are seeing? If so then it's likely pool members are actually being marked up/down.

they are coming in every minute or so..yes it started after I dropped the posted config lines. Just emails we are not sending snmp at this point. says ltm is not a directory. but the pool is up and so are the nodes and i can still see the emails flooding inbound up/down