For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

zobaarul_333371's avatar
zobaarul_333371
Icon for Nimbostratus rankNimbostratus
Feb 26, 2019

LTM Logs for a specific pool member

Hi all, We are using Advanced Web "Application Firewall,i10800 (BIG-IP 13.1.1.2 Build 0.0.4)". We have installed it recently. There are many pools configured here. Lets say one of these is "pool_yyyy...
application delivery
BIG-IP
LTM
Michael_Saleem's avatar
Michael_Saleem
Icon for MVP rankMVP
Feb 27, 2019

By default the F5 should be logging when individual pool members fail their health monitor checks.

The syslog message ID for a pool member going down is 

01070638
and the severity level is 5 (notifications). You may want to try filtering the LTM logs based on this message ID

Example SysLog message

Feb 25 08:37:21 localhost.localdomain notice mcpd[7279]: 01070638:5: Pool /Common/POOL-192.168.1.101 member /Common/172.24.32.11:80 monitor status down. [ /Common/tcp: down; last error:  ]  [ was unchecked for 0hr:1min:8sec ]

Have you modified the syslog configuration by any chance?

What do you get from the following command?

list sys syslog all-properties