Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Answers

Email notification of node/vs down

I have searched for a while now, and have not found a solution.

Alertd appears to be the method of sending an email alert; how do I tell it a node is down?

Or a custom scripted monitor looked like a candidate.

I am not necessarily looking for the solution - just guidance of where to investigate further.
0
Rate this Question

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Hello,

First, you'd want to associate a monitor on the pool. Then you need to configure postfix to send mail remotely. And then configure alertd to send email. There are a few related solutions on AskF5 that you can use as a guide for this:

SOL3667: Configuring SNMP trap alerts to send email notifications
https://support.f5.com/kb/en-us/solutions/public/3000/600/sol3667.html?sr=392739

SOL3664: Configuring BIG-IP to deliver locally-generated email messages
https://support.f5.com/kb/en-us/solutions/public/3000/600/sol3664.html

And if you want to generate a message based on a custom log event, refer to SOL3727:

SOL3727: Configuring custom SNMP traps
https://support.f5.com/kb/en-us/solutions/public/3000/700/sol3727.html

Aaron
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Posted By hoolio on 01/28/2008 10:19 AM
There are a few related solutions on AskF5 that you can use as a guide for this:

SOL3667: Configuring SNMP trap alerts to send email notifications
https://support.f5.com/kb/en-us/solutions/public/3000/600/sol3667.html?sr=392739
Aaron



Regardiong this one, is there a way to add a default recipient email address?

The example only says about per alert config:

alert BIGIP_BIGPIPE_BP_CONFIGURATION_LOADED {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.28";
email toaddress="demo@askf5.com"
fromaddress="root@bigip1.askf5.com"
body="The test of this Solution worked!"
}


regards
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
As far as I'm aware, you need to configure each field individually for every alert definition.

I think there are some variables available for the hostname of the unit, but after digging through old notes, I can't find any documentation of this. Does anyone else know how you can use a variable which is resolved to the hostname of the unit in the alert.conf file?

Also, once you configure the alert.conf, make sure to back it up as I think it gets overwritten in upgrades.

Aaron
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Aaron,

I just wanted to thank you for your helpful post. I was looking to do something similar to the original poster and your links were exactly what I needed. Thanks,

d
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
I'd like to do the same thing. But how am I able to tell BigIP that a node is down?
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
You would need to configure a monitor for the pool. If the pool member(s) fail to respond correctly to the monitor requests, the monitoring daemon, bigd, will mark the member down and a syslog event is triggered.

Take a look at the LTM configuration guide for your version on AskF5.com for details on configuring monitors. Feel free to reply if you have any questions.

Aaron
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Thanks for your reply hoolio. I checked the links above and found that SNMP traps can be made to send email. Can a node down event generate a SNMP trap?
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Sure. Take a look at SOL3727 for details on how to configure alertd to trigger an email notification when a node is marked down.

https://support.f5.com/kb/en-us/solutions/public/3000/700/sol3727.html

alert.conf sample:


alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10";
email toaddress="support@example.com"
fromaddress="root@bigip.example.com"
body="Pool Member Status Down!"
}
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.11";
email toaddress="support@example.com"
fromaddress="root@bigip.example.com"
body="Pool Member Monitor Status Up"
}

alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.12";
email toaddress="support@example.com"
fromaddress="root@bigip.example.com"
body="Node Address Monitor Status Down!"
}
alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS_UP {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.13";
email toaddress="support@example.com"
fromaddress="root@bigip.example.com"
body="Node Address Monitor Status Up"
}


Aaron
0
Comments on this Answer
Comment made 20-Jul-2016 by RaymondF 0

How do I configure this just for specific pools? As each pool is owned by a different group.

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
I checked the alert.conf file on 9.3.1 and I found this.
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool member (.*?) : (.*?) monitor status down." {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10"
}
Would the ip address and port no. of the log message be substituted into (.*?) : (.*?) automatically, so that I can modify like this?
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool member (.*?) : (.*?) monitor status down." {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10"
email toaddress="a@b.com"
fromaddress="root@bigip.com"
body="Pool member (.*?) : (.*?) monitor status down."
}
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
The email message already includes the IP address and port in the email subject. I don't think the regex is applied to the syslog message when generating the body, so I don't think the expansion you've listed will work for getting the IP:port in the email body. I think there are some wildcards you can use in the email body. but I haven't been able to find any reference to them. Maybe you could open a case with F5 Support if you want to pursue this?

With this alert.conf entry:


alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10";
email toaddress="admin@example.com"
fromaddress="root@bigip.example.com"
body="Node Status Down!"
}


This email is sent:

From: root@bigip.example.com
Sent: Wednesday, March 26, 2008 5:38 PM
To: Admin
Subject: 01070638:5: Pool member 1.1.1.1:80 monitor status down.

Node Status Down!

Aaron
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Thanks hoolio. I'll give it a shot.
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Hi Aaron,
I tried this sample and noticed the following:
1) Only BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS is available from the /var/tmpfs/run/bigip_error_maps.dat file.
2) Only OID=".1.3.6.1.4.1.3375.2.4.0.10" never got activated (not .11)
3) I received multiple emails for the notification. Is this normal?

Thanks,

/Robert
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Hello,
is there any difference between the two posted alerts,
both use the same OIDs but have different descriptions,
will it be ok to leave the first ones in alter.conf and just add the last ones to the user_alter.conf?

    
/*
* from bigd (CR36393) -- changed from mcpd messages in v9.2.0 (CR46190) and hotfix v9.0.5
* For the following 4 alerts, messages need to be used in pattern match to
* distiguish different ipaddr, port, etc. So, if these messages are changed,
* the changes in alert system need to be done accordingly.
*/
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool member (.*?)<img src='http://devcentral.f5.com/desktopmodules/ntforums/images/emoticons/sad.gif' height='20' width='20' border='0' title='Sad' align='absmiddle'>.*?) monitor status down." {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10"
}
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_UP "Pool member (.*?)<img src='http://devcentral.f5.com/desktopmodules/ntforums/images/emoticons/sad.gif' height='20' width='20' border='0' title='Sad' align='absmiddle'>.*?) monitor status up." {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.11"
}

alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_DOWN "Node (.*?) monitor status down." {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.12"
}
alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_UP "Node (.*?) monitor status up." {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.13"
}



   
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10";
email toaddress="support@example.com"
fromaddress="root@bigip.example.com"
body="Pool Member Status Down!"
}
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.11";
email toaddress="support@example.com"
fromaddress="root@bigip.example.com"
body="Pool Member Monitor Status Up"
}

alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.12";
email toaddress="support@example.com"
fromaddress="root@bigip.example.com"
body="Node Address Monitor Status Down!"
}
alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_STATUS_UP {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.13";
email toaddress="support@example.com"
fromaddress="root@bigip.example.com"
body="Node Address Monitor Status Up"
}


Is there any way to insert the poolname into the email body?
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Hello,
I got this working, I really would like it,
but today I received 600 Emails from the BigIP where I added the email alerts.
This happend 2 times.

Is there a reason for this behaviour ?

greetings

Heiko
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Hey guys. I have this setup working for all our health monitors, but i would like to change 2 things. 1) Add/change hostname (instead of ip). 2) (and this is the most important) I want to include which health monitor has marked the node down.
In our setup we have some webservers with multiple virtualhosts where the same node is in multiple pools with different health monitors.
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
ingard,

I don't think either request is possible. There isn't a lookup done in the alerting process to see what node name might be configured for a particular pool member's address. And I don't think the monitoring daemon, bigd, includes the monitor name that marked the pool member down in the alert, so alertd wouldn't be able to include it in the alert message. You could open a case with F5 Support to find out if there are workarounds though.

Aaron
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
I just did, its too bad really as it would be very usefull to know which monitor did the flapping that occured "last night"
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
You could enable logging on bigd, but I think you'd get too much logging for everyday use if you have a large number of pools. To enable logging, you can run 'b db bigd.debug enable'. The output is written to /var/log/bigdlog. To disable the logging, run 'b db bigd.debug.disable'.

If you get more info on this from support, can you reply back?

Thanks,
Aaron
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Willdo, that debug output is really nice. I wish i knew about that option last time i was debugging a health monitor. All output from the health monitors goes there - really nice when u're trying to see whats going on.
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
After beeing pointed towards numerous links in the kb I think we finally got a breakthrough. Excerpt - mail from f5 support:

----------------------

Here is my test pool with 2 monitors applied to pool member 10.0.0.12:80:

pool mspiggy {
lb method member ratio
min active members 1
monitor all http
members
10.0.0.10:http
priority 2
10.0.0.11:http
priority 2
10.0.0.12:http
priority 2
monitor http and http_test
10.0.0.13:http
priority 2
10.0.0.14:http
}


Enable database key: bigd.lognodestatuschange

[root@pegleg:Active] ucs # b db bigd.lognodestatuschange enable
[root@pegleg:Active] ucs # b db bigd.lognodestatuschange
Bigd.LogNodeStatusChange = enable


[root@pegleg:Active] ucs # tail -f /var/log/ltm

1:- if only apply 1 monitor http to pool member, 10.0.0.12:80

Oct 6 14:22:54 pegleg mcpd[1486]: 01070639:5: Pool member 10.0.0.12:80 session status enabled.
Oct 6 14:22:54 pegleg bigd[1599]: 01060001:5: Service detected UP for ::ffff:10.0.0.12:80 monitor http.
Oct 6 14:22:55 pegleg mcpd[1486]: 01070727:5: Pool member 10.0.0.12:80 monitor status up.

...
2:- If applied 2 monitors (see above pool mspiggy configurations), http_test monitor failed, you can see:

Oct 6 14:23:14 pegleg bigd[1599]: 01060001:5: Service detected UP for ::ffff:10.0.0.12:80 monitor http.
Oct 6 14:23:25 pegleg bigd[1599]: 01060001:5: Service detected DOWN for ::ffff:10.0.0.12:80 monitor http_test.
Oct 6 14:23:25 pegleg mcpd[1486]: 01070638:5: Pool member 10.0.0.12:80 monitor status down.
Oct 6 14:23:28 pegleg mcpd[1486]: 01070639:5: Pool member 10.0.0.12:80 session status enabled.

You can configure alertd to use which monitor strings written down in /var/log/ltm, and you can define to send snmp trap for the strings you defined to monitor, see SOL3727

-----------------------------

ingard
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Hi ingard,

Thanks for posting the solution. I didn't know about the db option for bigd.lognodestatuschange.

Aaron
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Did anyone figure out how to substitute host name for IP in a pool member status alert?
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Is there a way to do this for a specific pool only. I.E. my UNIX team has servers with pool members that they want to know when one gets marked down, but they dont care if a Windows member in a different pool goes down. From what I can tell, this seems to be a "global" setting in that an email will be generated for any member of any pool.
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Is there a way to do this for a specific pool only. I.E. my UNIX team has servers with pool members that they want to know when one gets marked down, but they dont care if a Windows member in a different pool goes down. From what I can tell, this seems to be a "global" setting in that an email will be generated for any member of any pool.
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
The way I got this to work is a custom alert for each Node in front of the global one. Since it's a first match basis and you have to have a different alert name for each. The bold is the new one I inserted before the global wildcard.
Copied (with a few edits) from my /etc/alertd/alert.conf
* from bigd (CR36393) -- changed from mcpd messages in v9.2.0 (CR46190) and hotfix v9.0.5
* For the following 4 alerts, messages need to be used in pattern match to
* distiguish different ipaddr, port, etc. So, if these messages are changed,
* the changes in alert system need to be done accordingly.
*/
alert BIGIP_REVERSE_PROXY_DOWN "Pool member 192.168.1.1:8080 monitor status down." {
snmptrap OID=".1.2.6.1.4.1.3375.2.4.0.200";
email toaddress="joe@example.com,joe2@example.com"
fromaddress="BigIP@example.com"
body="<custom email message>"
}

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool member (.*?): <space inserted to get rid of emocon> (.*?) monitor status down." {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10"
}
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
That's good to know

The issue with modifying the alert.conf (as opposed to the user_alert.conf) is that the alert.conf isn't saved in a UCS file by default and even if you manually configure it so the alert.conf is saved in a UCS file, it could get overwritten in an upgrade/hotfix installation. So if you have a checklist for post-upgrade items, I'd suggest adding a check of the alert.conf.

You can modify the files saved in a UCS following the steps in SOL4422:

SOL4422: Viewing and modifying the files that are configured for inclusion in a UCS archive
https://support.f5.com/kb/en-us/solutions/public/4000/400/sol4422.html (Click here)

hwidjaja had a good solution which doesn't involve editing the alert.conf (Click here).

Aaron
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Thanks for that info Aaron! It's very appreciated especially since I'm very new to F5s, we have 10, and the newest code on one is 9.3.1 so I see updates in my future.

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Can anyone tell me how you get the OID of the alert? I don't see it in the syslogs
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Can you find it in /var/run/bigip_error_maps.dat?
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
I don't know for sure, but it's possible that any "MON_STATUS" OID will be triggered on *any* status change - so a change from up to down and back up may send off two alerts. Also note that a node status could affect a pool status, so if you're trapping on both it could case duplicates.

-Matt
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Hi All,

I know it's a long time since this tread ended but I have a question if thats ok...?? Did you ever manage to get the pool name into the email alert ? If so how was this achieved..
many thanks
Dan

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
sorry.. ignore last post..... hadn't come onto the second page when i sent the update...
ta
dan
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
-----------------------------------------------------------------------------------------------
alert BIGIP_REVERSE_PROXY_DOWN "Pool member 192.168.1.1:8080 monitor status down." {
snmptrap OID=".1.2.6.1.4.1.3375.2.4.0.200";
email toaddress="joe@example.com,joe2@example.com"
fromaddress="BigIP@example.com"
body=""
}

-----------------------------------------------------------------------------------------------
above,how about calculating the OID NO,thank you very much!
if you have any suggestion,please let me now
e-mail:joy_yang@pegatroncorp.com

best regards
david


0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Well... If you don't want to workout what the OID will be, you could always watch the traps come out using tcpdump or wireshark or similar (tcpdump on the F5 linux host would be better, then transfer the dump file to something with wireshark on it). Find the trap for the event you want to alert for and copy the OID from it.

H
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
hi Hamish,
    thanks.
by the way,how to do tcpdump?
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
On the linux host (i.e. ssh into the F5, or go in via the console for bash shell command line access) and type

tcpdump -i 0.0 -p -w /var/tmp/snmp_traps.dump -s 3000 port 162

Then that sits in the background putting a copy of all the packets that match the filter 'port 162' into the file /var/tmp/snmp_traps.dump (The -w parameter) without putting the interface into promiscuous mode (-p, although it's a bit of a moot point with the way the F5 packet capture works) and is listening on interface 0.0 (Which on f5 is a special ALL interfaces pseudo device).

Once a trap has been sent, ctrl-c the tcpdump, and copy the file off to where there's a copy of wireshark (tcpdump could do this for you as well, but unless you're familiar with it I'd recommend wireshark) and load the dumpfile. Find the trap and have a look at the OID that it was sent with.

H
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

hello Hamish,
         I did it several times,but i didn't got anything,please help again,thanks!

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
You need to find whether the problem is with the traps not going out, or the tcpdump not capturing the packets. Is the file completely empty?

H
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
i traps several times for serveral minutes,but i got nothing and the file completely empty,would you please help me?
thanks!
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Hello H,
         I've done it  several times for serveral minutes,but i got nothing and the file completely empty,would you please help me?
thank you very much!
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Is the how to apply o v10.2 as described for 9.x?
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Instead of mucking with syslog configs on the load balancer itself (which IMO this obvious request of an email alert when a node, pool, or critical event should never have to be implemented at a CLI level on each individual BIGIP box with the premimium people pay for F5 devices), try using SEC.  Just parse the SNMP traps from the F5 box on the server running SEC to trigger the event you want...basically to see the trap...parse it...then shell out and email you of the event)...why this is still not a part of EM I do not know...  

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Heres a baseline to make some SEC matches against F5 SNMP traps for node down, node up.


# SUPRESS MATCHES FROM EWBIGIP4 TO PREVENT DUPLICATE EMAILS
#
type=suppress
ptype=Substr
pattern=xxx.xxx.xxx (self ip of standby f5 on defalult gateway net)
desc=Supress Events for Traps from standby F5

# Service DOWN
#
type=single
ptype=regexp
pattern=(?i) (\S+) Pool member xxx.xxx.xxx:80 monitor status down.
desc=### WARNING ### HTTP Web Service on xxx.xxx.xxx DOWN.
action=pipe '%s' /usr/bin/mail -s 'F5 ALERT: WMS Web Service Node DOWN' abc@123

# Service UP
#
type=single
ptype=regexp
pattern=(?i) (\S+) Pool member xxx.xxx.xxx:80 monitor status up.
desc=### NOTIFICATION ### HTTP Web Service on xxx.xxx.xxx UP.
action=pipe '%s' /usr/bin/mail -s 'F5 NOTIFICATION: WMS Web Server Node UP' abc@123
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
do these still work for ver 10 and 11?
0
Comments on this Answer
Comment made 06-Jan-2015 by David Dennison 118
Not sure, we moved to Nagios to do checking of our F5's. But SEC should always work. The only thing between versions would be to make sure the trap message keeps the same format between versions. If it changes, just change the regexp pattern match to mirror the new trap message accordingly.
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Interesting! Could you give a working example, please?

Tnx,

Huub Dewachter.

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Hi All
Despite the syntax used from the document K3667, I have the error ' Feb 22 19:47:42 localhost emerg logger: Re-starting alertd'.
The error is looping. I have to copy an empty user_alert.conf file in order to stop it.
Below the conf added into file /config/user_alert.conf with the rights 644:

alert BIGIP_LIBHAL_HALERR_BLADE_POWERED_OFF {  
    snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.119";  
    lcdwarn description="Blade is about to be powered off." priority="4"  
    email toaddress="..."  
    fromaddress="..."  
    body="The test of this Solution worked!"  
}  

Thanks for help

0
Comments on this Answer
Comment made 22-Feb-2018 by Kevin.K

Greeting,
I took a quick peek at the article and didn't notice any mention of lcdwarn or description.

I removed those and it's working:

alert BIGIP_LIBHAL_HALERR_BLADE_POWERED_OFF {  
    snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.119";  
    email toaddress="..."  
    fromaddress="..."  
    body="The test of this Solution worked!"  
}  

Hopefully those aren't necessary for you?
Kevin

1
Comment made 23-Feb-2018 by aygitci 68

Thanks for your reply. Yes it's working now.
However I didn't receive the email. I'm wondering if I didn't choose the right SNMP OID.
Do you know on where I can find the triggered OID?

Thanks again :)

0
Comment made 23-Feb-2018 by Kevin.K

Sure thing!

So, internally, TMM is picking this message up "BIGIP_LIBHAL_HALERR_BLADE_POWERED_OFF".

Then it sends the trap with that OID. You could type anything in actually.

Have you following this article for configuring the SMTP mailhub on BIG-IP?

https://support.f5.com/csp/article/K13180

Lastly, if you are using domain names, have you set up a DNS name server on BIG-IP?

Thanks,
Kevin

1
Comment made 23-Feb-2018 by Kevin.K

Also, you should be able to test with the following from the BIG-IP advanced shell (bash):

logger -p local0.emerg "012a0012:0: Blade 2 is about to be powered off!"

0
Comment made 26-Feb-2018 by aygitci 68

Hi Kevin. Thanks for feedback.
I already configured SMTP via WebGUI but not helped.
As you advised I configured SMTP mailhub (DNS was already done).
Alert by email is working now.

0
Comment made 26-Feb-2018 by Kevin.K

The UI and CLI represent two different SMTP instances on BIG-IP. It's odd and I hope they fix that in the future.

Glad this is working for you and thanks for letting us know!

0