Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Answers

Email alerts while pool member up or down

We have some pools on which we want to setup email alerts so that whenever nodes are in and out of the pool they notify . Do we have a step by step solution to implement this?

0
Rate this Question
Comments on this Question
Comment made 22-Jul-2016 by RaymondF 0

I have made the changes on the alert.conf file and it worked just fine except for the from address even with an email address configured it still shows as root when it sends the alert.

Also can I customized alerts for specific pool group?

0

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Yes, the word member is required (I omitted it inadvertently on the second response). If you are matching a specific pool member, you will replace the "(.?):(.?)" with the pool member IP and port. So the text you provided is correct.

It appears that alertd uses egrep style matching (which, strictly speaking, means my use of the term "glob" isn't really correct). Thus, if your pool members are all in the same /24, you could do this:

Pool /Common/your_pool member 10.10.10.(.+):(.+?) monitor status down.

Alternatively, if you have a few IPs, you should be able to use the pipe:

Pool /Common/your_pool member (10.10.10.1|10.11.11.2):(.+?) monitor status down.

And if you have a constrained fourth octet:

Pool /Common/your_pool member 10.10.10.1[0-5]:(.+?) monitor status down.

The last one would match any IP between 10.10.10.10 and 10.10.10.15 (inclusive).

1
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

The precise details of the solution, and the options available to you, depend on the version of BIG-IP code which you are running. Under 11.x, following SOL3667:
  http://support.f5.com/kb/en-us/solutions/public/3000/600/sol3667.html?sr=34337345
and a slight modification from the user_alert.conf text found here:
  http://support.f5.com/kb/en-us/archived_products/sam/manuals/product/pg_4300/pg_4300_addfunct.html?sr=34336429

you could use the alertd mechanism. First, you need to follow the instructions in SOL13180 to configure outbound mail from the BIG-IP:
  http://support.f5.com/kb/en-us/solutions/public/13000/100/sol13180.html

Then, add the following to /config/user_alert.conf:

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool (.*?) member (.*?):(.*?) monitor status down." {
        email toaddress="receiver@yourcompany.com"
        fromaddress="root"
        body="A pool member went down"
}

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_UP "Pool (.*?) member (.*?):(.*?) monitor status up." {
        email toaddress="receiver@yourcompany.com"
        fromaddress="root"
        body="A pool member came back up"
}

This will email every time any member of any pool goes "down" or "up".

If you are running BIG-IP version 11.4.x, you may also consider using iCall.

0
Comments on this Answer
Comment made 10-Jan-2014 by F5Zan 88
Thanks Vernon. I want to do it for a certain pool and not all How can I achieve that?
0
Comment made 30-Dec-2015 by Jerry Lees
Yes, you'll need to modify the string portions that are "Pool (.*?)" in the up and down alerts to simply specify the pool you want to monitor and get emails about.
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Substitute the pool name (with partition) for the first grouped element, as in:

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool /Common/my-pool member (.*?):(.*?) monitor status down." { ...

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_UP "Pool /Common/my-pool member (.*?):(.*?) monitor status up." { ...
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Thanks

So if the pool name is UAT_PP_80 then it should be as follows?

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP "Pool /common/UAT_PP_80 monitor status down" { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10" email toaddress="receiver@yourcompany.com" fromaddress="root" body="A pool member went down"

}

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

The match is case exact, I believe, so /common must be /Common. Also, the other globs (the (.*?)'s) and the colon [:] between them are required, because the message in syslog will be something like:

  Pool /Common/UAT_PP_80 1.1.1.1:80 monitor status down.
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

does the syntax have member word in it ? like

Pool /Common/UAT_PP_80 member 1.1.1.1:80 monitor status down or is it without member ? You also talked about the globs and colon, are they mandatory as well? or they will be replaced by IP and port number? Can I add mutliple IP in the same line ?

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Many thanks for the useful info Vernon, I really appreciate it One last thing which I wanted to ask is when we have to create multiple alerts for different pools, is it a good idea to create a custom alerts ? like

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN_PoolName "Pool (.?) member (.?):(.*?) monitor status down." { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10"
email toaddress="receiver@yourcompany.com" fromaddress="root" body="A pool member went down" }

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN_PoolName_1 "Pool (.?) member (.?):(.*?) monitor status down." { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10" email toaddress="receiver@yourcompany.com" fromaddress="root" body="A pool member went down" }

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

If you are not going to customize the email message body or the trap OID on a per-pool basis, you may wish to use the matching method described above (though separate stanzas should work, too). If you will customize the message body and/or the OID, then I do believe you'll need to employ separate alertd stanzas, as you have above (but with pool names in the matcher string, of course).

0
Comments on this Answer
Comment made 14-Jan-2014 by F5Zan 88
So I created these two below alerts but did not receive anything. I have tested my smtp relay is functioning properly alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_CQ5_AUTH_QA_4504 "Pool /Common/CQ5_AUTH_QA_4504 member (10.14.90.60|10.14.90.61):4504 monitor status Down." { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10" email toaddress="xxx@abc.com" fromaddress="root" body="A pool member went down" } alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP_CQ5_AUTH_QA_4504 "Pool /Common/CQ5_AUTH_QA_4504 member (10.14.90.60|10.14.90.61):4504 monitor status up." { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.11" email toaddress="xxx@abc.com" fromaddress="root" body="A pool member went up" } Am I missing something here? syntax or soemthing else? Also i would like to know command to display smtp queue but couldn't find one
0
Comment made 21-Jan-2014 by Vernon
I didn't test your exact configuration, but I did notice that between ":4504" and "monitor" there are two spaces in both of your stanzas. Were those directly copy-and-pasted? If so, the extra space will cause a non-match. I also noticed that the word "Down" is capitalized, but I believe that in the actual log message, it is lower-case (i.e., "down"). If removing the space and altering the case don't do it, what is the exact line in the log when the pool member transitions to a "down" status, and what is the exact line when it transitions to an "up" status?
0
Comment made 05-Jun-2015 by Anthony Pineda 216
Just a follow-up on this. Is the use of snmptrap OID statement necessary or optional? If necessary should we not use custom snmptrap OID number range between 300 and 999 so as not to conflict with other OIDs?
0
Comment made 05-Jun-2015 by nitass 13357
snmptrap is not mandatory. if you just want email only, you can remove snmptrap line.
0
Comment made 30-Dec-2015 by Phani Teja Parasa 2
nitass, have you got the solution?
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Hi, Not sure if this post is still active. I am having an issue of Duplicate email when I configured Pool member status alerts. It worked for all the LTMs but from only one LTM I am getting duplicate email when the node goes up or down with only fraction on seconds of difference.

I modified the /config/user_alert.conf file and added the alert there, also I added a Failover alert in /etc/alertd/alert.conf file .... I don't know what went wrong

Any recommendations ???

0
Comments on this Answer
Comment made 08-Dec-2016 by Vignesh Kumar A 55

Please find the working script copy and paste in /config/user_alert.conf, for some reason "(.*?)" getting changed to (.?) or (._?).

So use (.*?) all along the script

alert POOLMEMBER-IS-UP "Pool (._?) member (._?):(.*?) monitor status up." { email toaddress="youremailid.com" fromaddress="root" body="A pool member came back up" }

alert POOLMEMBER-IS-DOWN "Pool (._?) member (._?):(.*?) monitor status down." { email toaddress="youremailid.com" fromaddress="root" body="A pool member down" }

alert VIRTUALSERVER-IS-UP "SNMP_TRAP: Virtual (.*?) available" { email toaddress="youremailid.com" fromaddress="root" body="A Virtual Server came back up" }

alert VIRTUALSERVER-IS-DOWN "SNMP_TRAP: Virtual (.*?) unavailable" { email toaddress="youremailid.com" fromaddress="root" body="A Virtual Server down"

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

I am facing issue when i apply the virtual server alert config , pool config worked fine , i am running 11.6.1

alertd service keep on restarting , so i reverted back , any body have the working config

kindly share

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Hi guys, I know this post is old but i have a question regarding this post. I am trying to add multiple pool names into single alert

Pool /Common/your_pool member 10.10.10.(.+):(.+?) monitor status down.

Not sure if I can modify the above command as follows

Pool /Common/your_pool1 /Common/your_pool2 /Common/your_pool3 member (.*?):(.*?) monitor status down.

0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

See the first answer in the post. You should be able to do something like this:

Pool /Common/your_pool(1|2|3) member (.+?) monitor status down.

I haven't tested that specifically, but it or something quite close should work.

0
Comments on this Answer
Comment made 3 months ago by Amy003 237

I am not sure but does AVR not cover all this ? in an easier way ?

0