Forum Discussion

Cirrus

Dec 16, 2019

Pool availability through HSL

Hi, is it possible to send pool availability logs via HSL? Those logs automatically appear within LTM logs, we would need to send those via High speed logging. Thanks, Zdenek

Dario_Garrido
Dec 17, 2019
Hello Zdenda.

Yes, of course you can.

Taking into account your log messages are something like this:
Tue Dec 17 21:02:46 CET 2019 notice bigip mcpd[5785] 01070727 Pool /Common/P-WEB1_80 member /Common/N-WEB1_172.16.100.1:80 monitor status up. [ /Common/inband: up ] [ was up for 492hrs:18mins:57sec ] Tue Dec 17 21:03:46 CET 2019 notice bigip mcpd[5785] 01070727 Pool /Common/P-WEB1_80 member /Common/N-WEB1_172.16.100.1:80 monitor status up. [ /Common/https_443: up ] [ was up for 492hrs:19mins:57sec ] Tue Dec 17 21:04:19 CET 2019 notice bipip mcpd[5785] 01070638 Pool /Common/P-WEB1_80 member /Common/N-WEB1_172.16.100.1:80 monitor status down. [ /Common/https: down; last error: ] [ was up for 492hrs:20mins:30sec ] Tue Dec 17 21:04:31 CET 2019 notice bigip mcpd[5785] 01070727 Pool /Common/P-WEB1_80 member /Common/N-WEB1_172.16.100.1:80 monitor status up. [ /Common/gateway_icmp: up ] [ was down for 0hr:0min:12sec ]
You should follow these steps:

1. Configure a Log Destination { > System > Logs > Configuration > Log Destinations }
Create a new destination
Select Remote High-Speed Log Type
Select Pool (remote syslog server)
Select protocol (TCP/UDP)
2. Configure a Log Publisher { > System > Logs > Configuration > Log Publishers }
Create a new publisher
Include your previous Log Destination profile
If you want to keep your local logging you should also include "sys-db-access-publisher"
3. Configure a Log Filter { > System > Logs > Configuration > Log Filters }
Create as many filters as messages ID you need to send
Severity: Notice
Message ID: 01070727, 01070638 (One filter by code)
Use the publisher previously created

This is just an example. You can create your own custom set of message ID using this table.
REF - https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/related/log-messages.html

KR,
Dario.

Dario_Garrido

MVP

Hello Zdenda.

Yes, of course you can.

Taking into account your log messages are something like this:

Tue Dec 17 21:02:46 CET 2019	notice	bigip	mcpd[5785]	01070727	Pool /Common/P-WEB1_80 member /Common/N-WEB1_172.16.100.1:80 monitor status up. [ /Common/inband: up ] [ was up for 492hrs:18mins:57sec ]
Tue Dec 17 21:03:46 CET 2019	notice	bigip	mcpd[5785]	01070727	Pool /Common/P-WEB1_80 member /Common/N-WEB1_172.16.100.1:80 monitor status up. [ /Common/https_443: up ] [ was up for 492hrs:19mins:57sec ]
Tue Dec 17 21:04:19 CET 2019	notice	bipip	mcpd[5785]	01070638	Pool /Common/P-WEB1_80 member /Common/N-WEB1_172.16.100.1:80 monitor status down. [ /Common/https: down; last error: ] [ was up for 492hrs:20mins:30sec ]
Tue Dec 17 21:04:31 CET 2019	notice	bigip	mcpd[5785]	01070727	Pool /Common/P-WEB1_80 member /Common/N-WEB1_172.16.100.1:80 monitor status up. [ /Common/gateway_icmp: up ] [ was down for 0hr:0min:12sec ]

You should follow these steps:

1. Configure a Log Destination { > System > Logs > Configuration > Log Destinations }

Create a new destination
Select Remote High-Speed Log Type
Select Pool (remote syslog server)
Select protocol (TCP/UDP)

2. Configure a Log Publisher { > System > Logs > Configuration > Log Publishers }

Create a new publisher
Include your previous Log Destination profile
If you want to keep your local logging you should also include "sys-db-access-publisher"

3. Configure a Log Filter { > System > Logs > Configuration > Log Filters }