Forum Discussion
NimbostratusSyslog & SMTP Alert question
Hi - we had SMTP alerts setup and working in our new test F5s (by altering ssmtp.conf & alertd.conf). Worked fine. We then setup syslog via the configuration utility (created syslog server in pool, created log destinations/publishers/filters etc). This worked fine. However we noticed that the SMTP email alerts where no longer working (and tcpdump shows no attempt on port 25 to our SMTP relay). Eventually, we stripped out the syslog config.....SMTP starts working again. Can these two not co-exist (SMTP alert and syslog alert) at the same time? Using BIGIP 2000 LTM v 11.4.0.
5 Replies
gsharriAltostratus
The log filter/destination/publisher config refers High Speed Logging (HSL) not the syslog process. Any message handled by HSL is not seen by syslog or alertd so BIGIP cannot send traps or smtp alert. If you want to use HSL then alerting must be handled by the remote server that is receiving the messages.
flicky2000_1616Thanks for the input. Accepted that HSL is not actually using the syslog daemon. But ultimately the HSL config sends messages to our external syslog server fine. And SMTP alerts from F5 to our external SMTP relay work fine (nothing to do with HSL). So the question phrased differently is - can we not use HSL and SMTP email alerts at the same time? Thanks
- gsharri
No they cannot coexist. HSL filters grab messages before syslog/alertd gets to see them so any smtp alerting done by alertd will not work.
- flicky2000_1616
Many thanks. Not ideal as we wanted both SMTP and SYSLOG out of the F5s. But at least it explains what is happening.
- gsharri
You can get remote syslog and smtp alerting both out of the bigip, you just can't use HSL filters on top of that.
