CirrusHi experts,
Would you be able to advise if it is possible for BigIQ to send email alerts when a virtual server or pool or whatever events occurred on a particular LTM? I have already setup the smtp in bigiq and tried to navigate but coudnt see where I should set that configuration.
Thank you in advance.
CumulonimbusWhat version of BigIQ are you working on? In version 7/7.1 I think you can do this if you have deployed your Virtual servers via the Application section, but not for VS-es that were separately deployed, or VS-es that were created on the BigIP.
If you go to Monitoring - Alerts & Notifications, click Settings, you can see all the different alerts that can trigger email messages (The Enabled column), virtual server availability isn't one of them. It's mainly for device level alerts at the moment.
If you have deployed the VS via the Application section of BigIQ (using AS3), there is an Application Health Alert option inside the Application configuration. If you click on the Health icon in the application, you can configure the Application Health Rule, and there is an option to monitor the Virtual server status. (I can send you a few screenshots if it's useful)
Alternatively, you can have a look in Monitoring - Dashboards - Local Traffic - Virtual Servers and look for particular entries in there - basically following the log entries that Nikoolayy1 is talking about as well.
CirrusThanks Alex, I will update here soon my deployment is completed.
By the way would you be able to advise. Big-IQ is listening from Big-IP devices on which port? Is it also port 9300?
Reason is, my big-IP have multiple vlans...and I want my big-IQ to be routed. Not like I also create all vlans in big-IQ.
MVPYou can do it from the BIG-IQ GUI, have you checked ?
https://techdocs.f5.com/en-us/bigiq-7-0-0/big-iq-monitoring-and-reports/health-monitoring-and-alerts-using-smtp-and-snmp-alerts.html
CirrusI tried this already, what I am working on is for virtual server, pool and node when it flaps I should get an alert. I tried creating a dummy virtual server and disabled enabled it but nothing happens
MVPWhat about SNMP or syslog server or SIEM? You can forward the logs to them and they to create and send the email.
CumulonimbusGood luck!
Have a look here for all the ports that the BigIQ CM & DCD need; https://support.f5.com/csp/article/K15612#dcd
Most ports required by the BigIQ are for communication between CM and DCD though, so mainly check the "Requirements for DCD" section to see what you need for sending logs etc.
Each module roughly has its own port it listens on for receiving logs, and most of them can have a different IP address, apart from the LTM logging service. It shouldn't be a problem though to set it up in routed mode.
Cirrusguys i finally completed the deployment, enabling the AVR completes the deployment and now I am able to see big-ip events.
just have another question, is there a way we can filter the virtual server events, pools based on subnet range?
Like, I only want to see evens for specific IP address and get notified in email.
I tried creating and exploring the alerting rule but none of it works.
TIA!