This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Monitoring F5 ViPs in Orion

I am monitoring my F5s with SNMP. I am trying to setup alerting based on a few other threads but cannot seem to find what I am looking for.

I would like to monitor the VIPs on the F5 because people drain them, or turn them off, and forget to turn them back on... things like that.

When I look under my alert manager I see the following

F5 Device

F5 GTM Service

F5 Health Monitor

F5 LTM (Pool, Pool member, Server, Virtual IP Address, Virtual Servers)

I looked all through the Virtual IP Address but could not make anything useful come out of it.

Would anyone be able to point me in the correct direction?

  • After looking again and a again I may have found what I am looking for, kind of.

    Under Trigger conditions I selected F5 LTM Virtual IP Address

    Selected F5 LTM Virtual IP Address - F5 Status - is not equal to - Available

    in my alert I put in:

    ${N=SwisEntity;M=Device.Caption}

    ${N=SwisEntity;M=Name}

    TESTF5.My.Domain
    Name of the VIP (/Common/10.0.0.115)

    My issue now is it shows up as the IP address but I was hoping to get the DNS name.

  • Just had to talk it out I guess

    I switches it to Virtual Servers and then I was able to use the following:

    Under Trigger conditions I selected F5 LTM Virtual Servers

    Selected F5 LTM Virtual Servers - F5 Status - is not equal to - Available

    The VIP:

    ${N=SwisEntity;M=ShortName}

    on

    ${N=SwisEntity;M=F5Device.Caption}

    is down

  • Is there a way with this alert to display IP connecting to the VIP?

    Or to select a certain VIP status

  • There is also a different philosophy on alerting with a load balancer such as an F5, which might or might not apply to your situation. 

    1) Node1 - www1.example.com

    Full monitoring and alerting.  disk, memory, cpu, ping, SAM monitors.

    One of the sam monitors is the "keepalive" url.

    2) Node2 - www2.example.com - same as Node1

    3) F5 VIP.  www.example.com - This VIP address is added as a node WITHOUT the checkbox "Poll for F5 iControl"

    SAM monitors are added for the keepalive and other important pages.

    4) F5 management IP's are added as their own nodes with the "Poll for F5" checked.

    The keepalives mentioned above are URL's that the F5 uses to know if that server is an active member of the pool (note: I am not the F5 guy, so my terminology might be off).

    If the system admin, web developer, or automated patching system can rename the keepalive file on www1.  It will be removed from the F5 pool.  This will cause the SAM monitors on just that node to go red.  They can deal with that however they decide, such as silencing the monitor or node, or just taking the call from the helpdesk.  It's completely up to them.  The same for the second node.

    NOW, if they take down both nodes, or if the F5 administrator disabled the VIP or anything else odd happens and the whole website goes down, then node3 (the f5 vip) has different alert settings.  different people get notified, such as the website owner.

    The F5 admins can accidentally disable the Orion user used to monitor the F5s, and it might cause the F5's to alert, but it does not suddenly alert on every website we have. (false positives).  We can replace the F5 with another load balancer, and it doesn't change my Orion monitors (well except for #4)

    The F5 admins have their own nodes and alerting, the web guys have their own nodes and alerting, and the owners of the website can have their own nodes and alerting. And none of them cause false positives with the others.