We have some pools on which we want to setup email alerts so that whenever nodes are in and out of the pool they notify . Do we have a step by step solution to implement this?

The precise details of the solution, and the options available to you, depend on the version of BIG-IP code which you are running. Under 11.x, following SOL3667: http://support.f5.com/kb/en-us/solutions/public/3000/600/sol3667.html?sr=34337345 and a slight modification from the user_alert.conf text found here: http://support.f5.com/kb/en-us/archived_products/sam/manuals/product/pg_4300/pg_4300_addfunct.html?sr=34336429 you could use the alertd mechanism. First, you need to follow the instructions in SOL13180 to configure outbound mail from the BIG-IP: http://support.f5.com/kb/en-us/solutions/public/13000/100/sol13180.html Then, add the following to /config/user_alert.conf: alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool (.*?) member (.*?):(.*?) monitor status down." { email toaddress="receiver@yourcompany.com" fromaddress="root" body="A pool member went down" } alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_UP "Pool (.*?) member (.*?):(.*?) monitor status up." { email toaddress="receiver@yourcompany.com" fromaddress="root" body="A pool member came back up" } This will email every time any member of any pool goes "down" or "up". If you are running BIG-IP version 11.4.x, you may also consider using iCall.

Thanks Vernon. I want to do it for a certain pool and not all How can I achieve that?

Substitute the pool name (with partition) for the first grouped element, as in: alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool /Common/my-pool member (.*?):(.*?) monitor status down." { ... alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_UP "Pool /Common/my-pool member (.*?):(.*?) monitor status up." { ...

Email alerts while pool member up or down

35 Replies

VernonWells
Employee
Jan 13, 2014
If you are not going to customize the email message body or the trap OID on a per-pool basis, you may wish to use the matching method described above (though separate stanzas should work, too). If you will customize the message body and/or the OID, then I do believe you'll need to employ separate alertd stanzas, as you have above (but with pool names in the matcher string, of course).
- F5Zan_89516
  Nimbostratus
  Jan 15, 2014
  So I created these two below alerts but did not receive anything. I have tested my smtp relay is functioning properly alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_CQ5_AUTH_QA_4504 "Pool /Common/CQ5_AUTH_QA_4504 member (10.14.90.60|10.14.90.61):4504 monitor status Down." { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10" email toaddress="xxx@abc.com" fromaddress="root" body="A pool member went down" } alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP_CQ5_AUTH_QA_4504 "Pool /Common/CQ5_AUTH_QA_4504 member (10.14.90.60|10.14.90.61):4504 monitor status up." { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.11" email toaddress="xxx@abc.com" fromaddress="root" body="A pool member went up" } Am I missing something here? syntax or soemthing else? Also i would like to know command to display smtp queue but couldn't find one
- VernonWells
  Employee
  Jan 21, 2014
  I didn't test your exact configuration, but I did notice that between ":4504" and "monitor" there are two spaces in both of your stanzas. Were those directly copy-and-pasted? If so, the extra space will cause a non-match. I also noticed that the word "Down" is capitalized, but I believe that in the actual log message, it is lower-case (i.e., "down"). If removing the space and altering the case don't do it, what is the exact line in the log when the pool member transitions to a "down" status, and what is the exact line when it transitions to an "up" status?
- Anthony_Pineda
  Nimbostratus
  Jun 05, 2015
  Just a follow-up on this. Is the use of snmptrap OID statement necessary or optional? If necessary should we not use custom snmptrap OID number range between 300 and 999 so as not to conflict with other OIDs?
RaymondF_247317
Nimbostratus
Jul 22, 2016
I have made the changes on the alert.conf file and it worked just fine except for the from address even with an email address configured it still shows as root when it sends the alert.

Also can I customized alerts for specific pool group?
Frank_245395
Nimbostratus
Nov 16, 2016
Hi, Not sure if this post is still active. I am having an issue of Duplicate email when I configured Pool member status alerts. It worked for all the LTMs but from only one LTM I am getting duplicate email when the node goes up or down with only fraction on seconds of difference.

I modified the /config/user_alert.conf file and added the alert there, also I added a Failover alert in /etc/alertd/alert.conf file .... I don't know what went wrong

Any recommendations ???
- Vignesh_Kumar_A
  Nimbostratus
  Dec 08, 2016
  Please find the working script copy and paste in /config/user_alert.conf, for some reason "(.*?)" getting changed to (.?) or (._?).
  
  So use (.*?) all along the script
  
  alert POOLMEMBER-IS-UP "Pool (._?) member (._?):(.*?) monitor status up." { email toaddress="youremailid.com" fromaddress="root" body="A pool member came back up" }
  
  alert POOLMEMBER-IS-DOWN "Pool (._?) member (._?):(.*?) monitor status down." { email toaddress="youremailid.com" fromaddress="root" body="A pool member down" }
  
  alert VIRTUALSERVER-IS-UP "SNMP_TRAP: Virtual (.*?) available" { email toaddress="youremailid.com" fromaddress="root" body="A Virtual Server came back up" }
  
  alert VIRTUALSERVER-IS-DOWN "SNMP_TRAP: Virtual (.*?) unavailable" { email toaddress="youremailid.com" fromaddress="root" body="A Virtual Server down"
Macaron
Nimbostratus
Nov 16, 2016
Hi, Not sure if this post is still active. I am having an issue of Duplicate email when I configured Pool member status alerts. It worked for all the LTMs but from only one LTM I am getting duplicate email when the node goes up or down with only fraction on seconds of difference.

I modified the /config/user_alert.conf file and added the alert there, also I added a Failover alert in /etc/alertd/alert.conf file .... I don't know what went wrong

Any recommendations ???
- Vignesh_Kumar_A
  Nimbostratus
  Dec 08, 2016
  Please find the working script copy and paste in /config/user_alert.conf, for some reason "(.*?)" getting changed to (.?) or (._?).
  
  So use (.*?) all along the script
  
  alert POOLMEMBER-IS-UP "Pool (._?) member (._?):(.*?) monitor status up." { email toaddress="youremailid.com" fromaddress="root" body="A pool member came back up" }
  
  alert POOLMEMBER-IS-DOWN "Pool (._?) member (._?):(.*?) monitor status down." { email toaddress="youremailid.com" fromaddress="root" body="A pool member down" }
  
  alert VIRTUALSERVER-IS-UP "SNMP_TRAP: Virtual (.*?) available" { email toaddress="youremailid.com" fromaddress="root" body="A Virtual Server came back up" }
  
  alert VIRTUALSERVER-IS-DOWN "SNMP_TRAP: Virtual (.*?) unavailable" { email toaddress="youremailid.com" fromaddress="root" body="A Virtual Server down"
Snl
Cirrostratus
May 03, 2017
I am facing issue when i apply the virtual server alert config , pool config worked fine , i am running 11.6.1

alertd service keep on restarting , so i reverted back , any body have the working config

kindly share
Macaron
Nimbostratus
Aug 16, 2018
Hi guys, I know this post is old but i have a question regarding this post. I am trying to add multiple pool names into single alert

Pool /Common/your_pool member 10.10.10.(.+):(.+?) monitor status down.

Not sure if I can modify the above command as follows

Pool /Common/your_pool1 /Common/your_pool2 /Common/your_pool3 member (.*?):(.*?) monitor status down.
VernonWells
Employee
Aug 21, 2018
See the first answer in the post. You should be able to do something like this:

Pool /Common/your_pool(1|2|3) member (.+?) monitor status down.

I haven't tested that specifically, but it or something quite close should work.
- Amresh008
  Nimbostratus
  Dec 30, 2018
  I am not sure but does AVR not cover all this ? in an easier way ?
Vernon_97235
Historic F5 Account
Aug 21, 2018
See the first answer in the post. You should be able to do something like this:

Pool /Common/your_pool(1|2|3) member (.+?) monitor status down.

I haven't tested that specifically, but it or something quite close should work.
- Amresh008
  Nimbostratus
  Dec 30, 2018
  I am not sure but does AVR not cover all this ? in an easier way ?