SNMP traps for Pool members status change

[Alex_05_143110]

Hi All, I'm trying to setup F5 BigIP LTM to send SNMP traps when the pool members status changed. I read those ones: https://support.f5.com/kb/en-us/solutions/public/3000/700/sol3727.html https://support.f5.com/kb/en-us/solutions/public/6000/400/sol6414.html?sr=628246 https://support.f5.com/kb/en-us/solutions/public/11000/100/sol11127.html and added following records into user_alert.conf file

Code

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_DOWN "Pool member (.*?) monitor status      down."{
    snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10"
}
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UPP "Pool member (.*?) monitor status up."{
    snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.11"}

alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS_Down "Node (.*?) monitor status down."{
    snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.12"
}
alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS_UP "Node (.*?) monitor status UP."{
    snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.13"}

Code

But when I try to test SNMP trap by this command logger -p local0.warning "Node 10.10.64.14 monitor status down." it just does nothing (I monitored management interface by tcpdump). And the same thing when I just make one of the pool members offline. Only when I restarting snmpd service I see the snpm traffic from mgmt interface to net monitoring system. Can somebody advice what I did wrong?

[Darrell_G_36120 · Accepted solution]

Hi Alex,

Did you ever get a resolution for this problem? We recently upgraded to 11.2.1 from 10.4 and are no longer seeing any SNMP traps. We have a node still on 10.4 and they work fine. I was just curious as to what you found with your issue. Thanks!

[nitass]

aren't those traps enable by default?

e.g.

[root@ve11-8:Active:In Sync] config  grep monitor\ status /var/run/bigip_error_maps.dat
0 LOG_NOTICE    01070638 BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS "Pool %s member %s:%u monitor status %s."
0 LOG_NOTICE    01070640 BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS "Node %s address %s monitor status %s."
0 LOG_NOTICE    01070727 BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP "Pool %s member %s:%u monitor status up."
0 LOG_NOTICE    01070728 BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS_UP "Node %saddress %s monitor status up."

[root@ve11-8:Active:In Sync] config  grep -A3 BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS /etc/alertd/alert.conf
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS {
        snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10"
}
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP {
        snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.11"
}

[root@ve11-8:Active:In Sync] config  grep -A3 BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS /etc/alertd/alert.conf
alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS {
        snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.12"
}
alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS_UP {
        snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.13"
}

[Alex_130243]

They supposed to be enabled by default but Idon't see any SNMP activity on interface when those events occur. I will open a support case with F5 regarding this behavior.

[Darrell_G_36120]

Hi Alex,

Did you ever get a resolution for this problem? We recently upgraded to 11.2.1 from 10.4 and are no longer seeing any SNMP traps. We have a node still on 10.4 and they work fine. I was just curious as to what you found with your issue. Thanks!

[Alex_23778 · Accepted solution]

Hi Darrell, yes I got a resolution from F5 guys. My problem was in the configuration of my management network. My F5 devices have management IP addresses in different network subnet than my production network, where SNMP server lives. So when they sent their SNMP traps they did it by IP address from production network not by management one. So when those traps were received by SNMP server it just didn't recognize them, because F5 devices have only management addresses assigned to them. So I had to make F5 devices send SNMP using management network using this command: Code tmsh create /sys management-route lognet network "SNMP Server IP address/255.255.255.255 gateway "management network gateway IP Address" /Code

[Darrell_G_36120 · Accepted solution]

Hi Alex,

Did you ever get a resolution for this problem? We recently upgraded to 11.2.1 from 10.4 and are no longer seeing any SNMP traps. We have a node still on 10.4 and they work fine. I was just curious as to what you found with your issue. Thanks!