Email notification of node/vs down

Hello,

 

 

First, you'd want to associate a monitor on the pool. Then you need to configure postfix to send mail remotely. And then configure alertd to send email. There are a few related solutions on AskF5 that you can use as a guide for this:

 

 

SOL3667: Configuring SNMP trap alerts to send email notifications

 

https://support.f5.com/kb/en-us/solutions/public/3000/600/sol3667.html?sr=392739

 

 

SOL3664: Configuring BIG-IP to deliver locally-generated email messages

 

https://support.f5.com/kb/en-us/solutions/public/3000/600/sol3664.html

 

 

And if you want to generate a message based on a custom log event, refer to SOL3727:

 

 

SOL3727: Configuring custom SNMP traps

 

https://support.f5.com/kb/en-us/solutions/public/3000/700/sol3727.html

 

 

Aaron

Posted By hoolio on 01/28/2008 10:19 AM

 

There are a few related solutions on AskF5 that you can use as a guide for this:

 

 

SOL3667: Configuring SNMP trap alerts to send email notifications

 

https://support.f5.com/kb/en-us/solutions/public/3000/600/sol3667.html?sr=392739

 

Aaron

 

 

 

 

Regardiong this one, is there a way to add a default recipient email address?

 

 

The example only says about per alert config:

 

 

alert BIGIP_BIGPIPE_BP_CONFIGURATION_LOADED {

 

snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.28";

 

email toaddress="demo@askf5.com"

 

fromaddress="root@bigip1.askf5.com"

 

body="The test of this Solution worked!"

 

}

 

 

 

regards

 

As far as I'm aware, you need to configure each field individually for every alert definition.

 

 

I think there are some variables available for the hostname of the unit, but after digging through old notes, I can't find any documentation of this. Does anyone else know how you can use a variable which is resolved to the hostname of the unit in the alert.conf file?

 

 

Also, once you configure the alert.conf, make sure to back it up as I think it gets overwritten in upgrades.

 

 

Aaron

Aaron,

 

 

I just wanted to thank you for your helpful post. I was looking to do something similar to the original poster and your links were exactly what I needed. Thanks,

 

 

d

I'd like to do the same thing. But how am I able to tell BigIP that a node is down?

You would need to configure a monitor for the pool. If the pool member(s) fail to respond correctly to the monitor requests, the monitoring daemon, bigd, will mark the member down and a syslog event is triggered.

 

 

Take a look at the LTM configuration guide for your version on AskF5.com for details on configuring monitors. Feel free to reply if you have any questions.

 

 

Aaron

Thanks for your reply hoolio. I checked the links above and found that SNMP traps can be made to send email. Can a node down event generate a SNMP trap?

Sure. Take a look at SOL3727 for details on how to configure alertd to trigger an email notification when a node is marked down.

https://support.f5.com/kb/en-us/solutions/public/3000/700/sol3727.html

alert.conf sample:

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10";
email toaddress="support@example.com"
fromaddress="root@bigip.example.com"
body="Pool Member Status Down!"
}
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.11";
email toaddress="support@example.com"
fromaddress="root@bigip.example.com"
body="Pool Member Monitor Status Up"
}
alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.12";
email toaddress="support@example.com"
fromaddress="root@bigip.example.com"
body="Node Address Monitor Status Down!"
}
alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS_UP {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.13";
email toaddress="support@example.com"
fromaddress="root@bigip.example.com"
body="Node Address Monitor Status Up"
}

Aaron

I checked the alert.conf file on 9.3.1 and I found this.

 

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool member (.*?) : (.*?) monitor status down." {

 

snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10"

 

}

 

Would the ip address and port no. of the log message be substituted into (.*?) : (.*?) automatically, so that I can modify like this?

 

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool member (.*?) : (.*?) monitor status down." {

 

snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10"

 

email toaddress="a@b.com"

 

fromaddress="root@bigip.com"

 

body="Pool member (.*?) : (.*?) monitor status down."

 

}

 

The email message already includes the IP address and port in the email subject. I don't think the regex is applied to the syslog message when generating the body, so I don't think the expansion you've listed will work for getting the IP:port in the email body. I think there are some wildcards you can use in the email body. but I haven't been able to find any reference to them. Maybe you could open a case with F5 Support if you want to pursue this?

With this alert.conf entry:

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS {
        snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10";
        email toaddress="admin@example.com"
                fromaddress="root@bigip.example.com"
                body="Node Status Down!"
}

This email is sent:

From: root@bigip.example.com

Sent: Wednesday, March 26, 2008 5:38 PM

To: Admin

Subject: 01070638:5: Pool member 1.1.1.1:80 monitor status down.

Node Status Down!

Aaron