VIP down alerts

By default, the LTM tries to retain logs for 10 days.

K13367: Managing log files on the BIG-IP system (11.x - 13.x)

Increasing the log options from default or adding irule logging may impact the ability of the LTM to retain the default logs. If additional log levels or longer retention is required, then configuring HSL or a remote syslog server is recommended.

Within the ltm log file in /var/log/ltm, pool member and virtual server state changes are recorded with messages such as

notice mcpd[5261]: 01070638:5: Pool /Common/my_http_pool member /Common/10.0.0.145:80 monitor status down. [ /Common/http: down; last error: ] [ was up for 502hrs:48mins:43sec ]

notice mcpd[5261]: 01071682:5: SNMP_TRAP: Virtual /Common/my_https_vs has become unavailable

You can use zgrep to search for these events in the ltm log files

 zgrep "has become unavailable" /var/log/ltm*

ltm: notice mcpd[5261]: 01071682:5: SNMP_TRAP: Virtual /Common/my_https_vs has become unavailable