For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

davidfisher's avatar
davidfisher
Icon for Cirrus rankCirrus
Jun 13, 2019

Script to run TCPDUMP when monitor goes down

Hi We have the script here and I have created this alert to trigger it in /config/user_alert.conf but seems its not enough and something is a miss. Any ideas please? https://devcentral.f5.c...
BIG-IP
security
davidfisher's avatar
davidfisher
Icon for Cirrus rankCirrus
Jun 13, 2019

The timer setting is in secs or mins? What do you think?

And I am trying to trigger it with this: 

 logger -p local0.notice "Pool /Common/pool_one member /Common/10.1.62.61:0 monitor status down."

Should I see an SNMP TRAP for this test logger command as well?

Normally I see this when a pool mon fails: 

Jun 13 14:41:24 bigip2 notice mcpd[8183]: 01070638:5: Pool /Common/gateway-failsafe member /Common/10.1.62.61:0 monitor status down. [ /Common/gateway_icmp: down; last error: /Common/gateway_icmp: N
o successful responses received before deadline. @2019/06/13 14:41:24.  ]  [ was up for 0hr:0min:55sec ]
Jun 13 14:41:25 bigip2 notice mcpd[8183]: 01070638:5: Pool /Common/auction-php-pool member /Common/10.1.62.61:80 monitor status down. [ /Common/http: down; last error: /Common/http: Unable to connec
t; No successful responses received before deadline. @2019/06/13 14:41:25.  ]  [ was up for 0hr:0min:56sec ]
Jun 13 14:41:25 bigip2 notice mcpd[8183]: 01071682:5: SNMP_TRAP: Virtual /Common/auction-http-vs has become unavailable
Jun 13 14:41:25 bigip2 notice mcpd[8183]: 01071682:5: SNMP_TRAP: Virtual /Common/auction-https has become unavailable

How did you choose the msg ""Non-existent pool member for pool /Common/demo.app/demo_adfs_pool_443".

I think my msg is not matching the trap I configured, but why..?

davidfisher's avatar
davidfisher
Icon for Cirrus rankCirrus
Jun 13, 2019

I am doing the same thing: 

Jun 13 17:48:29 bigip2 notice mcpd[8183]: 01070638:5: Pool /Common/gateway-failsafe member /Common/10.1.62.61:0 monitor status down. [ /Common/gateway_icmp: down; last error: /Common/gateway_icmp: No successful responses received before deadline. @2019/06/13 17:48:29.  ]  [ was up for 0hr:0min:44sec ]
Jun 13 17:48:30 bigip2 notice mcpd[8183]: 01070638:5: Pool /Common/auction-php-pool member /Common/10.1.62.61:80 monitor status down. [ /Common/http: down; last error: /Common/http: Tcp read: No route to host; Unable to connect @2019/06/13 17:48:30.  ]  [ was up for 0hr:0min:45sec ]
Jun 13 17:48:30 bigip2 notice mcpd[8183]: 01071682:5: SNMP_TRAP: Virtual /Common/auction-http-vs has become unavailable
Jun 13 17:48:30 bigip2 notice mcpd[8183]: 01071682:5: SNMP_TRAP: Virtual /Common/auction-https has become unavailable
Jun 13 17:48:30 bigip2 notice mcpd[8183]: 010719e7:5: Virtual Address /Common/10.1.61.62 general status changed from GREEN to RED.
Jun 13 17:48:30 bigip2 notice mcpd[8183]: 010719e8:5: Virtual Address /Common/10.1.61.62 monitor status changed from UP to DOWN.

And made the script chmod +x as well: 

-rw-rw----.  1 mysql  mysql        72 2019-06-12 15:15 #sql2bb7_c_0.MYD
-rwxr-xr-x.  1 root   root       2727 2019-06-13 14:27 Pool-tshoot-script.sh
-rw-r--r--.  1 root   root     137104 2019-06-13 17:17 logstatd.log

Did you change anything in the script itself? The timer?