Dos Attacks not showing on dashboard
Issue: DoS attacks are not showing on the DoS dashboard. Information: Strange part is this was working but then I made a few changes to split this particular virtual server into internal and external VIPs only apply DoS profile to external VIP. I have a DoS logging profile enabled on this VS I know attacks are happening as I can see them under Security > Event logs > DoS > Application Events However, any of the new attack ids don’t show under the DoS Dashboard located Security > Reporting > DoS > Dashboards Any thoughts on how to fix would be much appreciated? Thanks!
Dashboard red dots that say "Click to view config changes near this time"
Recently I noticed these red dots on the 11.4.1 dashboard that say "Click to view config changes near this time" when you hover over them. When you click a dot it gives you all sorts of useful info about the object that was modified/created/deleted, but it doesn't say who made the changes. I've searched the logs using the following commands but don't get anything useful: zcat /var/logs/audit.*.gz | grep zcat /var/logs/ltm.*.gz | grep All I get is an entry that says "user=root" saved the config and other entries that state the newly created objects were marked down. If only there was a place to look that links the username with the objects. Those red dots in the dashboard are awesome, but they miss that one critical piece of information (username). I'm sure if it were easy to do, or even possible, F5 would have done it. I guess I'm just venting. Anybody know any tricks?
Modified /Common/system mgmt_dhcp -- What is this?
Hi, I have a GTM that is a VIPRION guest. It runs 11.5.1 HF10. I noticed something strange in the Dashboard and I was wondering if anyone has encountered it before. Every Friday at around 7am, my GTM's throughput and connections drop by about 80%, then spike back up and continue on with a normal pattern. 2 weeks out of 4 there has been a Configuration Object Change. We haven't made any changes. The change is something I can't find any information about: Change Details - Modified /Common/system mgmt_dhcp instance-name /Common/system field_name mgmt_dhcp class-name system container (no value) config_source user No one has been complaining, and I just now noticed this. There's nothing in GLSB/Local Traffic/System logs around that time. We have another GTM vCMP guest running the same version, which shares config changes with this GTM. They aren't an HA pair though. The other GTM has the same symptoms, but it happened only 1 out of 4 weeks this month. Thanks, K
Exposing F5 dashboard publicly?
Is it possible to expose F5 dashboard publicly (or at least with really minimal access to F5 Configuration Utility)? I'd like to expose it to machine displaying dashboards on display wall yet I wouldn't like to give it full access to actual F5 Configuration Utility interface. My question is either: How to expose dashboard without requiring authentication / requiring different authentication than F5 Configuration Utility or: Is there any lower permissions level for account in F5 than Guest that allows dashboard access or can this role permissions be even reduced to access only selected statistics required for dashboard operation? Another related topic would be: is it possible to expose dashboard on other vlan than management? For example as conventional Virtual Sever in some other network with destination pointing to F5 management IP?Dashboard and logs show different bandwidth utilization?
I can't figure this one out, so I figure I'd ask the experts! I've found multiple times that the performance view or the dashboard on the F5 don't correlate to local traffic logs about bandwidth. I've seen this multiple times, but here is an example from yesterday with my 200Mbps LTM. The dashboard showed this (grabbed historic from performance statistics). At the same time, I was getting flooded with messages like this from my system local traffic log. Tue Jun 27 08:05:06 PDT 2017 notice PERF-F5 tmm[11064] 01010045 Bandwidth utilization is 244 Mbps, exceeded 75% of Licensed 200 Mbps I've looked at it multiple times and it just doesn't add up. I've had this issue in multiple environments. Can someone explain to me where I can actually see the bandwidth I'm using if it's not being represented in the dashboard? Thanks!What is Exact Througput
Hi guys, I'm trying to figure out max throughput on LTM. So I've seen "Dashboard", "Performance Graph(Throughput)", "CLI Command(tmsh show sys performacne)". These values are all different. dashboard value changes in every 3 sec.( Performance graph(per 10sec), show sys perforamance throughput(8~15sec)) I'd like to know. What is real(?) Throughput? and Why there is difference?, What is difference? How LTM displays the throughput value. (polling OID internally? or something) If you know about this, HELP ME. Thank you, in advance.MIB and/or OID of dashboard graph of throughput
Not having any luck finding the MIB for the throughput graph shown in the dashboard. I have all mibs downloaded and a snmpwalk of the host, but cannot find anything relevant that matches up. Can someone please point me in the right direction? BIG-IP VPR-C2400 11.4.1 Build 608.0 Final Closest previous post I could find here: https://devcentral.f5.com/questions/help-finding-oid-for-gtm-performance-graph
