cancel
Showing results for 
Search instead for 
Did you mean: 
Login & Join the DevCentral Connects Group to watch the Recorded LiveStream (May 12) on Basic iControl Security - show notes included.

Big-IQ to send email for alerts and events

f5mkuDefault
Cirrus
Cirrus

Hi experts,

 

Would you be able to advise if it is possible for BigIQ to send email alerts when a virtual server or pool or whatever events occurred on a particular LTM? I have already setup the smtp in bigiq and tried to navigate but coudnt see where I should set that configuration.

 

Thank you in advance.

7 REPLIES 7

You can do it from the BIG-IQ GUI, have you checked ?

 

https://techdocs.f5.com/en-us/bigiq-7-0-0/big-iq-monitoring-and-reports/health-monitoring-and-alerts-using-smtp-and-snmp-alerts.html

I tried this already, what I am working on is for virtual server, pool and node when it flaps I should get an alert. I tried creating a dummy virtual server and disabled enabled it but nothing happens

What about SNMP or syslog server or SIEM? You can forward the logs to them and they to create and send the email.

AlexBCT
MVP
MVP

What version of BigIQ are you working on? In version 7/7.1 I think you can do this if you have deployed your Virtual servers via the Application section, but not for VS-es that were separately deployed, or VS-es that were created on the BigIP.

 

If you go to Monitoring - Alerts & Notifications, click Settings, you can see all the different alerts that can trigger email messages (The Enabled column), virtual server availability isn't one of them. It's mainly for device level alerts at the moment.

 

If you have deployed the VS via the Application section of BigIQ (using AS3), there is an Application Health Alert option inside the Application configuration. If you click on the Health icon in the application, you can configure the Application Health Rule, and there is an option to monitor the Virtual server status. (I can send you a few screenshots if it's useful) 

 

Alternatively, you can have a look in Monitoring - Dashboards - Local Traffic - Virtual Servers and look for particular entries in there - basically following the log entries that Nikoolayy1 is talking about as well.

Thanks Alex, I will update here soon my deployment is completed.

 

By the way would you be able to advise. Big-IQ is listening from Big-IP devices on which port? Is it also port 9300?

 

Reason is, my big-IP have multiple vlans...and I want my big-IQ to be routed. Not like I also create all vlans in big-IQ.

AlexBCT
MVP
MVP

Good luck!

 

Have a look here for all the ports that the BigIQ CM & DCD need; https://support.f5.com/csp/article/K15612#dcd

Most ports required by the BigIQ are for communication between CM and DCD though, so mainly check the "Requirements for DCD" section to see what you need for sending logs etc.

 

Each module roughly has its own port it listens on for receiving logs, and most of them can have a different IP address, apart from the LTM logging service. It shouldn't be a problem though to set it up in routed mode.

f5mkuDefault
Cirrus
Cirrus

guys i finally completed the deployment, enabling the AVR completes the deployment and now I am able to see big-ip events.

 

just have another question, is there a way we can filter the virtual server events, pools based on subnet range?

Like, I only want to see evens for specific IP address and get notified in email.

 

I tried creating and exploring the alerting rule but none of it works.

TIA!