F5 BigIP Email Alerts

If you do not have a monitoring package that ties into your F5 LTM SNMP then email notifications provide a decent alternative. You can configure the BigIP 9 software to notify an email address or alias regarding the alerts that concern you.

The first step is to configure Postfix on your LTM devices. F5 provides a step by step doc in SOL3664 on the AskF5 site. Essentially configuring Postfix boils down to 3 things.

1. edit the /etc/postfix/main.cf - The F5 solution provides one configuration. I recommend reviewing the options in the config and modifying the main.cf to match the specifics of your mail infrastructure. Postfix is a popular mail server so a lot of useful info Googleverse.

2. start up Postfix

• # bigstart start postfix

or

• From the Main tab of the BIG-IP Configuration utility, click System
• Click Services
• Select the box next to postfix
• Click the Start button

3. test your setup

• # echo test | mail
• View the mail queue to ensure the message was sent by typing the following command: mailq
• To send any unsent mail, type the following command: postfix flush

An optional, but recommended, step is to create an email alias for the team members whom you wish to received the notifications.

• Edit the /etc/postfix/aliases file.
• Add a line to the end of the file with your alias info.
• example: pool-alarms: someone@support.com, otherguy@support.com, metoo@support.com
• Run the command newaliases to update your running config

Once mail is functioning for the LTM device, the alerts can be setup. F5 offers two ways to do this, modifying the standard alerts (SOL3667) and creating custom alerts (SOL3727). I will focus on the first option here. One note on the custom alert option, if your customer alert is a subset of an alert covered in the standard alert it will not generate an alert. For example, if you create an alert for a specific pool member down, the general pool member down alert will capture the event first and the custom alert will not fire. If there is a way around this, I have not found it yet.

To configure the standard alerts for email notifications do the following:
1. back up the /etc/alertd/alert.conf file by typing the following command:
cp /etc/alertd/alert.conf /etc/alertd/alert.conf.bak
2. edit the /etc/alertd/alert.conf file

From SOL3667
This file consists of numerous alert definitions in the following format:

alert ALERT_NAME {
snmptrap OID=""
}

The alert definitions may appear similar to the following example:

alert BIGIP_BIGPIPE_BP_CONFIGURATION_LOADED {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.28"
}

Modify the alert definition for each alert that you want to receive an email as follows:

email toaddress=""
fromaddress=""
body=

Important: Alert entries must be separated with a semi-colon ( ; ) character. You must add a semi-colon to the end of the line for the previous alert entry.

In the following example, the previous alert entry is an snmptrap entry. For example, the following modified alert sends an email using the email toaddress, fromaddress, and body options:

alert BIGIP_BIGPIPE_BP_CONFIGURATION_LOADED {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.28";
email toaddress="demo@askf5.com"
fromaddress="root@bigip1.askf5.com"
body="The test of this Solution worked!"
}

Note: You can send the email to multiple recipients by separating the email addresses with a comma ( , ) character, as shown in the following example:

email toaddress="demo@askf5.com,demo2@askf5.com"

3. Save and exit the file
4. Restart the alertd by issuing the command:
# bigstart restart alertd
5. test your settings. The simplest way to do is to generate a real test. For the example above, running bigpipe load should generate a message.

Another option is using the logger command. This command allows you to generate syslog-ng messages directly. This may be a preferable method in production environments for testing things like pool member offline alerts. To use logger do the following:

• find the syslog message string in the trap you configured for email alerts. For example, alert BIGIP_MCPD_MCPDERR_NODE_ADDRESS_MON_DOWN "Node (.*?) monitor status down." The quoted section is the syslog message.
• replace the (.*?) regular expression with valid information from you config. For the example above choose an IP address of one of the monitored nodes.
• logger -p local0.warning "Node 10.10.10.10 monitor status down."
• The command will output a syslog message t0 the local0.warning facility and an SNMP trap will be generated. This event should trigger the alertd email.