Email alerts while pool member up or down

The precise details of the solution, and the options available to you, depend on the version of BIG-IP code which you are running. Under 11.x, following SOL3667:

you could use the alertd mechanism. First, you need to follow the instructions in SOL13180 to configure outbound mail from the BIG-IP:

Then, add the following to /config/user_alert.conf:

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool (.*?) member (.*?):(.*?) monitor status down." {
        email toaddress="receiver@yourcompany.com"
        fromaddress="root"
        body="A pool member went down"
}

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_UP "Pool (.*?) member (.*?):(.*?) monitor status up." {
        email toaddress="receiver@yourcompany.com"
        fromaddress="root"
        body="A pool member came back up"
}

This will email every time any member of any pool goes "down" or "up".

If you are running BIG-IP version 11.4.x, you may also consider using iCall.

The precise details of the solution, and the options available to you, depend on the version of BIG-IP code which you are running. Under 11.x, following SOL3667:

you could use the alertd mechanism. First, you need to follow the instructions in SOL13180 to configure outbound mail from the BIG-IP:

Then, add the following to /config/user_alert.conf:

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool (.*?) member (.*?):(.*?) monitor status down." {
        email toaddress="receiver@yourcompany.com"
        fromaddress="root"
        body="A pool member went down"
}

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_UP "Pool (.*?) member (.*?):(.*?) monitor status up." {
        email toaddress="receiver@yourcompany.com"
        fromaddress="root"
        body="A pool member came back up"
}

This will email every time any member of any pool goes "down" or "up".

If you are running BIG-IP version 11.4.x, you may also consider using iCall.

Substitute the pool name (with partition) for the first grouped element, as in:

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN "Pool /Common/my-pool member (.*?):(.*?) monitor status down." { ...

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_UP "Pool /Common/my-pool member (.*?):(.*?) monitor status up." { ...

Thanks

So if the pool name is UAT_PP_80 then it should be as follows?

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP "Pool /common/UAT_PP_80 monitor status down" { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10" email toaddress="receiver@yourcompany.com" fromaddress="root" body="A pool member went down"

}

The match is case exact, I believe, so /common must be /Common. Also, the other globs (the (.*?)'s) and the colon [:] between them are required, because the message in syslog will be something like:

  Pool /Common/UAT_PP_80 1.1.1.1:80 monitor status down.

does the syntax have member word in it ? like

Pool /Common/UAT_PP_80 member 1.1.1.1:80 monitor status down or is it without member ? You also talked about the globs and colon, are they mandatory as well? or they will be replaced by IP and port number? Can I add mutliple IP in the same line ?

Yes, the word member is required (I omitted it inadvertently on the second response). If you are matching a specific pool member, you will replace the "(.?):(.?)" with the pool member IP and port. So the text you provided is correct.

It appears that alertd uses egrep style matching (which, strictly speaking, means my use of the term "glob" isn't really correct). Thus, if your pool members are all in the same /24, you could do this:

Pool /Common/your_pool member 10.10.10.(.+):(.+?) monitor status down.

Alternatively, if you have a few IPs, you should be able to use the pipe:

Pool /Common/your_pool member (10.10.10.1|10.11.11.2):(.+?) monitor status down.

And if you have a constrained fourth octet:

Pool /Common/your_pool member 10.10.10.1[0-5]:(.+?) monitor status down.

The last one would match any IP between 10.10.10.10 and 10.10.10.15 (inclusive).

Many thanks for the useful info Vernon, I really appreciate it One last thing which I wanted to ask is when we have to create multiple alerts for different pools, is it a good idea to create a custom alerts ? like

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN_PoolName "Pool (.?) member (.?):(.*?) monitor status down." { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10"

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_DOWN_PoolName_1 "Pool (.?) member (.?):(.*?) monitor status down." { snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10" email toaddress="receiver@yourcompany.com" fromaddress="root" body="A pool member went down" }

If you are not going to customize the email message body or the trap OID on a per-pool basis, you may wish to use the matching method described above (though separate stanzas should work, too). If you will customize the message body and/or the OID, then I do believe you'll need to employ separate alertd stanzas, as you have above (but with pool names in the matcher string, of course).

If you are not going to customize the email message body or the trap OID on a per-pool basis, you may wish to use the matching method described above (though separate stanzas should work, too). If you will customize the message body and/or the OID, then I do believe you'll need to employ separate alertd stanzas, as you have above (but with pool names in the matcher string, of course).