Can you get into the ltm logs?
And then look for the phrase
Virtual Address /Common/<Virtual Server IP> general status changed from GREEN to RED.
Virtual Address /Common/<Virtual Server IP> monitor status changed from UP to DOWN.
If you are looking at flappping for any reason, there are the same messages with "..RED to GREEN" or ..."DOWN to UP" if you want to see when it goes back online.
Hope that helps?
Yeah that i believe is the node flapping log? The problem is I am unable to see logs on the external sys-log server. I wanted to see if there are VIPs that are completely offline for past 90 days on a particular LTM
I took take a different approach. Since it seems you don't have this information in your SIEM, you could generate it locally. I had a couple of scripts doing this:
Unfortunately the script was written in my pre-Git time and also at my previous employer, so it's not available for sharing. But it was a simple bash script with a bit of sed and awk.
While the TMStat data is available at the CLI, via a command like
tmctl virtual_server_stat -s name,clientside.pkts_in,clientside.pkts_out
Which will show you clientside traffic stats per virtual server. In the CLI, it may be a bit harder to sort the data and see the patterns of use that you care about.
This is available in iHealth in a much more consumable and interactive format. Under the Commands menu, in the Utilities tree, you can select Virtual Server Traffic. See the image below:
Now in that page you can sort by any column header to see which virtual servers have not seen any traffic since the last reboot or when stats were cleared on the platform.