For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Fab's avatar
Fab
Icon for Altostratus rankAltostratus
Sep 11, 2024

user alert on apm logs

I try to trigger a command when a specific log is written on /var/log/apm

It works on 2 different non prod big-ip, but on a third one in production it only works with /var/log/ltm logs.

 

user_alert.conf

"failed" is commun in my ltm logs. "New session" is commun in apm logs.


So this works (triggered from ltm logs):

alert test "failed" { exec command="logger -p local0.notice 'test'" }

This doesn't (not triggered from apm logs):

alert test "New session" { exec command="logger -p local0.notice 'test'" }

 

Do you have any idea why?

3 Replies

  • Hello Fab,

    BIG-IP APM messages are not processed by the alertd SNMP process, and therefore custom scripts/traps cannot be triggered based on syslog messages for BIG-IP APM systems.

    REF: https://my.f5.com/manage/s/article/K6414

    • Fab's avatar
      Fab
      Icon for Altostratus rankAltostratus

      Actually it works on v15 and not anymore on v17. This is why it was working on some devices and not on some others.

    • Fab's avatar
      Fab
      Icon for Altostratus rankAltostratus

      Thanks. 

      It's very strange because it does work on 2 different bigip but not on the 3rd. This misled me...