Forum Discussion

davidfisher's avatar
davidfisher
Icon for Cirrus rankCirrus
Jun 13, 2019

Script to run TCPDUMP when monitor goes down

Hi We have the script here and I have created this alert to trigger it in /config/user_alert.conf but seems its not enough and something is a miss. Any ideas please? https://devcentral.f5.c...
BIG-IP
security
davidfisher's avatar
davidfisher
Icon for Cirrus rankCirrus

The timer setting is in secs or mins? What do you think?

And I am trying to trigger it with this: 

 logger -p local0.notice "Pool /Common/pool_one member /Common/10.1.62.61:0 monitor status down."

Should I see an SNMP TRAP for this test logger command as well?

Normally I see this when a pool mon fails: 

Jun 13 14:41:24 bigip2 notice mcpd[8183]: 01070638:5: Pool /Common/gateway-failsafe member /Common/10.1.62.61:0 monitor status down. [ /Common/gateway_icmp: down; last error: /Common/gateway_icmp: N
o successful responses received before deadline. @2019/06/13 14:41:24.  ]  [ was up for 0hr:0min:55sec ]
Jun 13 14:41:25 bigip2 notice mcpd[8183]: 01070638:5: Pool /Common/auction-php-pool member /Common/10.1.62.61:80 monitor status down. [ /Common/http: down; last error: /Common/http: Unable to connec
t; No successful responses received before deadline. @2019/06/13 14:41:25.  ]  [ was up for 0hr:0min:56sec ]
Jun 13 14:41:25 bigip2 notice mcpd[8183]: 01071682:5: SNMP_TRAP: Virtual /Common/auction-http-vs has become unavailable
Jun 13 14:41:25 bigip2 notice mcpd[8183]: 01071682:5: SNMP_TRAP: Virtual /Common/auction-https has become unavailable

How did you choose the msg ""Non-existent pool member for pool /Common/demo.app/demo_adfs_pool_443".

I think my msg is not matching the trap I configured, but why..?

davidfisher's avatar
davidfisher
Icon for Cirrus rankCirrus
Jun 13, 2019

I am doing the same thing: 

Jun 13 17:48:29 bigip2 notice mcpd[8183]: 01070638:5: Pool /Common/gateway-failsafe member /Common/10.1.62.61:0 monitor status down. [ /Common/gateway_icmp: down; last error: /Common/gateway_icmp: No successful responses received before deadline. @2019/06/13 17:48:29.  ]  [ was up for 0hr:0min:44sec ]
Jun 13 17:48:30 bigip2 notice mcpd[8183]: 01070638:5: Pool /Common/auction-php-pool member /Common/10.1.62.61:80 monitor status down. [ /Common/http: down; last error: /Common/http: Tcp read: No route to host; Unable to connect @2019/06/13 17:48:30.  ]  [ was up for 0hr:0min:45sec ]
Jun 13 17:48:30 bigip2 notice mcpd[8183]: 01071682:5: SNMP_TRAP: Virtual /Common/auction-http-vs has become unavailable
Jun 13 17:48:30 bigip2 notice mcpd[8183]: 01071682:5: SNMP_TRAP: Virtual /Common/auction-https has become unavailable
Jun 13 17:48:30 bigip2 notice mcpd[8183]: 010719e7:5: Virtual Address /Common/10.1.61.62 general status changed from GREEN to RED.
Jun 13 17:48:30 bigip2 notice mcpd[8183]: 010719e8:5: Virtual Address /Common/10.1.61.62 monitor status changed from UP to DOWN.

And made the script chmod +x as well: 

-rw-rw----.  1 mysql  mysql        72 2019-06-12 15:15 #sql2bb7_c_0.MYD
-rwxr-xr-x.  1 root   root       2727 2019-06-13 14:27 Pool-tshoot-script.sh
-rw-r--r--.  1 root   root     137104 2019-06-13 17:17 logstatd.log

Did you change anything in the script itself? The timer?