I am attempting to create an alert for our F5 load balancers, specifically if there aren't any SSL connections on the active server but reduced to only certain F5 devices. The issue I am seeing has to do with a few of the F5's alerting even though they aren't being included in the alert. Am I missing something in the logic with this alert? I have tried to accomplish this several different ways but the attached screenshots seem to be the best for capturing SSL connection drops. Does anyone have any pointers b/c I am pretty much stumped? Thanks in advance!!!!
Answered the question myself....the inclusion of NodeID 1049 into the list was causing a false alert from this device b/c it doesn't use SSL. I ended up using the logic in the attached screenshot to get the job done and it's seemingly alerting the way I intended. Are there any items in this alert that I should change or take out? Thanks for the help!