Forum Discussion

davidfisher's avatar
davidfisher
Icon for Cirrus rankCirrus
Jun 13, 2019

Script to run TCPDUMP when monitor goes down

Hi We have the script here and I have created this alert to trigger it in /config/user_alert.conf but seems its not enough and something is a miss. Any ideas please? https://devcentral.f5.c...
BIG-IP
security
davidfisher's avatar
davidfisher
Icon for Cirrus rankCirrus
Jun 17, 2019

I was trying the script on v12.1.

 

Is this workaround required for all versions? Which version are you running?

Simon_Blakely's avatar
Simon_Blakely
Icon for Employee rankEmployee
Jun 17, 2019

I developed that solution on 12.1.2, and I expect it to be required for all later versions.

 

It's complex, but it is reliable - just trying to run tcpdump out of user_alerts.conf may work (for example, it initially worked on my development 12.1.2 VE), but not for all cases (it didn't work on a physical 12.1.2 VCMP guest in the lab).

 

The solution I documented above does provide results.

However - it isn't instant, but using alertd introduces a delay anyhow.