email alerts for down nodes

e.g.

[root@ve10:Active] config  cat /config/user_alert.conf
alert POOL_MEMBER_STATUS_DOWN "Pool member (.*?) monitor status down." {
  email toaddress="nitass@f5.com"
  fromaddress="BIG-IPLTM@aaa.com"
  body=""
}

 /var/log/ltm

[root@ve10:Active] config  grep -i down /var/log/ltm
Jul 30 17:18:46 local/ve10 notice mcpd[3851]: 01070638:5: Pool member 200.200.200.101:80 monitor status down.

 email notification

From: BIG-IPLTM@aaa.com [mailto:BIG-IPLTM@aaa.com] 
Sent: Tuesday, July 30, 2013 5:19 PM
To: Nitass
Subject: 01070638:5: Pool member 200.200.200.101:80 monitor status down.

I used this and all i get is the following log messages

 

 

[admin@LTM:Active:Changes Pending] ~ Jul 30 16:02:22 LTM emerg logger: Re-starting alertd

 

Jul 30 16:02:33 LTM emerg logger: Re-starting alertd

 

Jul 30 16:02:43 LTM emerg logger: Re-starting alertd

 

Jul 30 16:02:53 LTM emerg logger: Re-starting alertd

 

Jul 30 16:03:03 LTM emerg logger: Re-starting alertd

 

Jul 30 16:03:13 LTM emerg logger: Re-starting alertd

 

thanks for the direction I got it working now

Hello,

 

 

thanks for the thread and the answers.

 

 

I am trying to achieve the same on LTMs running 11.2.1 HF7, but with separate emails for down AND up.

 

 

In the logs, I have these entries, a bit different compared to yours:

 

[bchadmin@P02LBF02:Active:In Sync] ~ tail -f /var/log/ltm

 

2013-08-08T14:58:12+02:00 P02LBF02 notice mcpd[6578]: 01070638:5: Pool /Common/POOL_P02-PROD-FE-HTTPS-EPDQ-ISP4 member /Common/VNDMZFE26:81 monitor status down. [ was up for 3hrs:58mins:50sec ]

 

2013-08-08T14:58:12+02:00 P02LBF02 notice mcpd[6578]: 01070638:5: Pool /Common/POOL_P02-PROD-FE-HTTPS-GENERIC-ISP3 member /Common/VNDMZFE26:81 monitor status down. [ was up for 3hrs:58mins:50sec ]

 

2013-08-08T14:58:12+02:00 P02LBF02 notice mcpd[6578]: 01070638:5: Pool /Common/POOL_P02-PROD-FE-HTTPS-GENERIC-ISP4 member /Common/VNDMZFE26:81 monitor status down. [ was up for 3hrs:58mins:50sec ]

 

2013-08-08T14:58:17+02:00 P02LBF02 notice mcpd[6578]: 01070727:5: Pool /Common/POOL_P02-PROD-FE-CLAUTH-VPSP-ISP3 member /Common/VNDMZFE26:81 monitor status up. [ was down for 0hr:0min:5sec ]

 

2013-08-08T14:58:17+02:00 P02LBF02 notice mcpd[6578]: 01070727:5: Pool /Common/POOL_P02-PROD-FE-CLAUTH-VPSP-ISP4 member /Common/VNDMZFE26:81 monitor status up. [ was down for 0hr:0min:5sec ]

 

2013-08-08T14:58:17+02:00 P02LBF02 notice mcpd[6578]: 01070727:5: Pool /Common/POOL_P02-PROD-FE-HTTPS-EPDQ-ISP3 member /Common/VNDMZFE26:81 monitor status up. [ was down for 0hr:0min:5sec ]

 

2013-08-08T14:58:17+02:00 P02LBF02 notice mcpd[6578]: 01070727:5: Pool /Common/POOL_P02-PROD-FE-HTTPS-EPDQ-ISP4 member /Common/VNDMZFE26:81 monitor status up. [ was down for 0hr:0min:5sec ]

 

2013-08-08T14:58:17+02:00 P02LBF02 notice mcpd[6578]: 01070727:5: Pool /Common/POOL_P02-PROD-FE-HTTPS-GENERIC-ISP3 member /Common/VNDMZFE26:81 monitor status up. [ was down for 0hr:0min:5sec ]

 

2013-08-08T14:58:17+02:00 P02LBF02 notice mcpd[6578]: 01070727:5: Pool /Common/POOL_P02-PROD-FE-HTTPS-GENERIC-ISP4 member /Common/VNDMZFE26:81 monitor status up. [ was down for 0hr:0min:5sec ]

 

 

 

Could someone please review the syntax below, it does not work for me ?

 

 

alert POOL_MEMBER_STATUS_DOWN "Pool (.*?) member (.*?) monitor status down." {

 

email toaddress="xxx"

 

fromaddress="yyy"

 

body=""

 

}

 

 

alert POOL_MEMBER_STATUS_UP "Pool (.*?) member (.*?) monitor status up." {

 

email toaddress="xxx"

 

fromaddress="yyy"

 

body=""

 

}

 

 

best regards,

 

 

--

 

Benoit

 

Could someone please review the syntax below, it does not work for me ? it looks okay to me. the ssmtp.conf is correct, isn't it? have you seen smtp packet sending out?

e.g.

 /config/user_alert.conf

[root@ve11a:Active:Changes Pending] config  cat user_alert.conf
alert TEST "Pool (.*?) member (.*?) monitor status down." {
        email toaddress="nitass@xxx.com"
        fromaddress="f5admin@yourdomain.com"
        body=""
}

 /var/log/ltm

[root@ve11a:Active:Changes Pending] config  cat /var/log/ltm
Aug  9 09:46:05 ve11a notice mcpd[6732]: 01070638:5: Pool /Common/foo member /Common/200.200.200.101:80 monitor status down. [ /Common/fake: down ]  [ was unchecked for 0hr:0min:7sec ]
Aug  9 09:46:05 ve11a err tmm[11073]: 01010028:3: No members available for pool /Common/foo
Aug  9 09:46:05 ve11a err tmm1[11073]: 01010028:3: No members available for pool /Common/foo

 email

-----Original Message-----
From: f5admin@yourdomain.com [mailto:f5admin@yourdomain.com] 
Sent: Friday, August 09, 2013 9:46 AM
To: Nitass
Subject: 01070638:5: Pool /Common/foo member /Common/200.200.200.101:80 monitor status down. [ /Common/fake: down ] [ was unchecked for 0hr:0min:7sec ]

Hello Nitass,

 

 

thanks for your reply.

 

Yes ssmtp.conf is configured, alertd has been restarted.

 

 

mailhub=mail.domain.xxx

 

Set this to never rewrite the "From:" line (unless not given) and to

 

use that address in the "from line" of the envelope.

 

FromLineOverride=YES

 

 

A test mail is OK:

 

[bchadmin@P02LBF02:Active:In Sync] ~ echo "ssmtp test mail" | mail -vs "Test email" bch@ogone.com

 

[<-] 220 Fri, 9 Aug 2013 09:56:33 +0200

 

[->] HELO

 

[<-] 250

 

[->] MAIL FROM:

 

[<-] 250 2.1.0 l....Sender OK

 

[->] RCPT TO:

 

[<-] 250 2.1.5 bch@ogone.com

 

[->] DATA

 

[<-] 354 Start mail input; end with .

 

[->] Received: by l (sSMTP sendmail emulation); Fri, 9 Aug 2013 09:56:32 +0200

 

[->] From: "root"

 

[->] Date: Fri, 9 Aug 2013 09:56:32 +0200

 

[->] To: bch@ogone.com

 

[->] Subject: Test email

 

[->]

 

[->] ssmtp test mail

 

[->] .

 

[<-] 250 2.6.0 Queued mail for delivery

 

[->] QUIT

 

[<-] 221 2.0.0l Service closing transmission channel

 

[bchadmin@P02LBF02:Active:In Sync] ~

 

 

And I get the test mail in my mailbox.

 

 

Prior to working with the user_alert.conf, I did follow this SOL:

 

https://support.f5.com/kb/en-us/solutions/public/3000/600/sol3667.html

 

 

But the result was the same, not able to get a mail sent.

 

I will remove custom entries in /etc/alert/alert.conf and keep you posted.

 

 

best regards,

 

 

--

 

Benoit

As with Benoit above, I am also seeing the exact same issue. I can receive a test email but no email for up/down nodes or Pools.

 

example output from my config:

 

alert BIGIP_GTMD_POOL_SNMP_STATUS_CHANGE_WHY_X "SNMP_TRAP: Pool .? state change .? --> red .*?" { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.41"; email toaddress="DL_Support@xxxx.com" fromaddress="ltm01-xxxx" body="Pool is DOWN, Investigate" }

 

Running: BIG-IP 11.3.0 3117.0

 

Surely it can't be that big of a job to have GUI options for configuring email alerts for VS/NODES/POOLS ?? It's a pretty basic ask and one that should have been nailed down in previous versions.

 

Here's what works for me - it's general for all pool members, but it works while we're working on getting our Vantage system to monitor the F5s.

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10";
email toaddress="someone@here.com, someoneelse@here.com, anotherguy@here.com"
fromaddress="root"
body="Critical: Pool member monitor status down."
}
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP {
    snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.11";
    email toaddress="someone@here.com, someoneelse@here.com, anotherguy@here.com"
    fromaddress="root"
    body="Critical: Pool member monitor status up."
}

The subject for an email notice then looks like this: 01070638:5: Pool /Common/pool_prod_membername member /Common/nodename:9083 monitor status down. [ was up for 0hr:3mins:46sec ] (slot1) where membername is the specific pool member's name and nodename is the node's name (obfuscated by me for security reasons).

Hope this helps...

Hello,

 

it has been a long time since I opened this thread. The problem of F5 not sending mails was still there, but I have been able to solve it today, with the help of our F5 integrator Secure Link.

 

The initial configuration, and its later amendments, was/were in fact OK. But the system did not trigger to send an email simply because of the 'iso-date' parameter at the syslog level.

 

As soon as I disabled it, mail alerting started to work like a charm. Our integrator will log a case with F5 to crosscheck if this behavior is as expected or not.

 

bchadmin@(P02LBF02)(cfg-sync In Sync)(Active)(/Common)(tmos) modify sys syslog iso-date disabled

 

regards, Hope this helps

 

Benoit