Forum Discussion

Anthonie's avatar
Anthonie
Icon for Altostratus rankAltostratus
Apr 11, 2022

Big-IQ HA logs

Hi,

We have a BIG-IQ HA setup with 4 servers. Two DCD and two mains. One as active and the other standby. When a failover happens for whatever reason i'm assuming there is some information about that written to a log file.

Does anyone know where that info is logged? Is it on the mains servers? Or would it be on the dcd's? And which file?

Thanks in advance

BIG-IQ
devops
ha
logging
  • Sebastiansierra's avatar
    Sebastiansierra
    Apr 12, 2022

    Hi,

    Without documentation, I recommend you open a support case with F5 level 4 " how-to ", because I am almost sure that these events are in var/log/ltm, but it's better if support confirms it if you can´t perform a failover.

    and the other question, the answer is Yes, Big-IQ is based on TMOS, and the OS is similar to Big-IP that runs TMOS inside too, you can try this command without any wrong behavior tmsh show /cm failover-status.

     

  • Sebastiansierra's avatar
    Sebastiansierra
    Icon for MVP rankMVP
    Apr 12, 2022

    Hi,

    Could you review in the Central Manager "Main for you" the path /var/log/ltm, the logs structure in the Big-IQ looks in some cases as in Big-IP devices.

    • Anthonie's avatar
      Anthonie
      Icon for Altostratus rankAltostratus
      Apr 12, 2022

      Hi thanks for for your input.

      In /var/log there is many logfiles, deamon, maillog, cron, restjavad etc. And as you said there is also ltm. Do you know what kind of event i would be looking for in that file? I'm not sure i can orchestrate a failover to try it out.

      Also, do you happen to know if there is any documentation on this?

      Thanks!

  • Sebastiansierra's avatar
    Sebastiansierra
    Icon for MVP rankMVP
    Apr 12, 2022

     

    Hi,

    If you made the failover this week, you probably have in the system files like ltm1, ltm2, ltm3 etc. these correspond to each day, so you can explore and research words like "failover" , "Standby", "HA".

    Additional, you can refer to the LTM documentation because for Big-IQ I never saw something relating to logs files:

    https://support.f5.com/csp/article/K16197

  • Anthonie's avatar
    Anthonie
    Icon for Altostratus rankAltostratus
    Apr 12, 2022

    Hi,

    My colleague mentioned the last failover was about a week and a half ago, so thats probably already out of logs. I see there is also an ha.log file. Is it possible that someone set up a custom logging location for high availabillity? And if that is the case can i check in the console if that is so?

     

  • Sebastiansierra's avatar
    Sebastiansierra
    Icon for MVP rankMVP
    Apr 12, 2022

    Hi,

    If you don´t have a Qkview when the failover occurred, unfortunately, isn´t possible to review the causes of the failover.

    Additional you can go deep in failover following this link

    https://support.f5.com/csp/article/K95002127

    To generate a Qkview in the case that failover ocurre :

     

    • Log in to the command line.
    • To run the qkview utility, type the following command: qkview
    • The output file name displays when the command has completed.
    • Collect the output file from the /var/tmp/ directory by copying the file to an external host using a utility such as ftp or scp.

     

  • Anthonie's avatar
    Anthonie
    Icon for Altostratus rankAltostratus
    Apr 12, 2022

    Ah sorry i should have better explained what my goal is.

    I want the log file with the failover logso i can have it exported to AWS cloudwatch. Right now im not looking for causes, just for the right file to send there so i can have some automation happen there for other systems. Hope that clears it up.

    In the link you send i found this command: "show /cm failover-status". Do you know if this will work for BIG-IQ too?

  • Sebastiansierra's avatar
    Sebastiansierra
    Icon for MVP rankMVP
    Apr 12, 2022

    Hi,

    Without documentation, I recommend you open a support case with F5 level 4 " how-to ", because I am almost sure that these events are in var/log/ltm, but it's better if support confirms it if you can´t perform a failover.

    and the other question, the answer is Yes, Big-IQ is based on TMOS, and the OS is similar to Big-IP that runs TMOS inside too, you can try this command without any wrong behavior tmsh show /cm failover-status.

     

  • Anthonie's avatar
    Anthonie
    Icon for Altostratus rankAltostratus
    Apr 14, 2022

    Thanks a lot for the input.

    I will monitor that file and the ha.log file which i found. When there is time for a failover ill check the logs to see what gets written where. If that doesnt work ill open a support case, or create a script to watch tmsh show /cm failover-status.

    I have to say though, documentation about logging is quite lacking, especially for big-IQ.