I have searched for a while now, and have not found a solution. Alertd appears to be the method of sending an email alert; how do I tell it a node is down? Or a custom scripted monitor looked like a candidate. I am not necessarily looking for the solution - just guidance of where to investigate further.

Hello, First, you'd want to associate a monitor on the pool. Then you need to configure postfix to send mail remotely. And then configure alertd to send email. There are a few related solutions on AskF5 that you can use as a guide for this: SOL3667: Configuring SNMP trap alerts to send email notifications https://support.f5.com/kb/en-us/solutions/public/3000/600/sol3667.html?sr=392739 SOL3664: Configuring BIG-IP to deliver locally-generated email messages https://support.f5.com/kb/en-us/solutions/public/3000/600/sol3664.html And if you want to generate a message based on a custom log event, refer to SOL3727: SOL3727: Configuring custom SNMP traps https://support.f5.com/kb/en-us/solutions/public/3000/700/sol3727.html Aaron

Posted By hoolio on 01/28/2008 10:19 AM There are a few related solutions on AskF5 that you can use as a guide for this: SOL3667: Configuring SNMP trap alerts to send email notifications https://support.f5.com/kb/en-us/solutions/public/3000/600/sol3667.html?sr=392739 Aaron Regardiong this one, is there a way to add a default recipient email address? The example only says about per alert config: alert BIGIP_BIGPIPE_BP_CONFIGURATION_LOADED { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.28"; email toaddress="demo@askf5.com" fromaddress="root@bigip1.askf5.com" body="The test of this Solution worked!" } regards

As far as I'm aware, you need to configure each field individually for every alert definition. I think there are some variables available for the hostname of the unit, but after digging through old notes, I can't find any documentation of this. Does anyone else know how you can use a variable which is resolved to the hostname of the unit in the alert.conf file? Also, once you configure the alert.conf, make sure to back it up as I think it gets overwritten in upgrades. Aaron

Aaron, I just wanted to thank you for your helpful post. I was looking to do something similar to the original poster and your links were exactly what I needed. Thanks, d

I'd like to do the same thing. But how am I able to tell BigIP that a node is down?

Email notification of node/vs down

hooleylist
Cirrostratus
Oct 06, 2008
Hi ingard,

Thanks for posting the solution. I didn't know about the db option for bigd.lognodestatuschange.

Aaron
John_Stewart_47
Nimbostratus
Oct 08, 2008
Did anyone figure out how to substitute host name for IP in a pool member status alert?
Spade_34749
Nimbostratus
Apr 15, 2009
The way I got this to work is a custom alert for each Node in front of the global one. Since it's a first match basis and you have to have a different alert name for each. The bold is the new one I inserted before the global wildcard.

Copied (with a few edits) from my /etc/alertd/alert.conf

* from bigd (CR36393) -- changed from mcpd messages in v9.2.0 (CR46190) and hotfix v9.0.5

* For the following 4 alerts, messages need to be used in pattern match to

* distiguish different ipaddr, port, etc. So, if these messages are changed,

* the changes in alert system need to be done accordingly.

*/

alert BIGIP_REVERSE_PROXY_DOWN "Pool member 192.168.1.1:8080 monitor status down." {

snmptrap OID=".1.2.6.1.4.1.3375.2.4.0.200";

email toaddress="joe@example.com,joe2@example.com"

fromaddress="BigIP@example.com"

body=""

}

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool member (.*?): (.*?) monitor status down." {

snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10"

}
hooleylist
Cirrostratus
Apr 16, 2009
That's good to know

The issue with modifying the alert.conf (as opposed to the user_alert.conf) is that the alert.conf isn't saved in a UCS file by default and even if you manually configure it so the alert.conf is saved in a UCS file, it could get overwritten in an upgrade/hotfix installation. So if you have a checklist for post-upgrade items, I'd suggest adding a check of the alert.conf.

You can modify the files saved in a UCS following the steps in SOL4422:

SOL4422: Viewing and modifying the files that are configured for inclusion in a UCS archive

https://support.f5.com/kb/en-us/solutions/public/4000/400/sol4422.html (Click here)

hwidjaja had a good solution which doesn't involve editing the alert.conf (Click here).

Aaron
Spade_34749
Nimbostratus
Apr 16, 2009
Thanks for that info Aaron! It's very appreciated especially since I'm very new to F5s, we have 10, and the newest code on one is 9.3.1 so I see updates in my future.
Joe_Pipitone
Nimbostratus
Jun 09, 2009
Can anyone tell me how you get the OID of the alert? I don't see it in the syslogs
hwidjaja_37598
Altostratus
Jun 12, 2009
Can you find it in /var/run/bigip_error_maps.dat?
L4L7_53191
Nimbostratus
Jun 12, 2009
I don't know for sure, but it's possible that any "MON_STATUS" OID will be triggered on *any* status change - so a change from up to down and back up may send off two alerts. Also note that a node status could affect a pool status, so if you're trapping on both it could case duplicates.

-Matt
dan_6764
Nimbostratus
Apr 19, 2010
Hi All,

I know it's a long time since this tread ended but I have a question if thats ok...?? Did you ever manage to get the pool name into the email alert ? If so how was this achieved..

many thanks

Dan
dan_6764
Nimbostratus
Apr 19, 2010
sorry.. ignore last post..... hadn't come onto the second page when i sent the update...

ta

dan