F5 has the ability to send out an email for various events like the failure of a pool member. For 10.x code version, Postfix within F5 can be utilized to send out emails. Beginning in 11.x code version, Postfix is not utilized. We would have to utilize SSMTP with mail-server: SOL13180
A Simple Step-by-Step Configuration Process (10.x Code Version):
- Save the Existing Configuration & Create Configuration Archive before making any changes to the existing configuration.
Get CLI-TMSH access to the F5 device:
(tmos)#save sys config partitions all
- Make sure F5 is configured with DNS Servers:
(tmos)#list sys dns
If there are no DNS Servers configured, add your DNS Servers and make sure F5 can access them:
(tmos)#modify sys dns name-servers add {1.1.1.1}
- Make sure that PostFix is running from tmsh:
show sys service postfix
start sys service postfix
modify sys service postfix add
list sys service | grep regexp Boot postfix
- Run a test email from F5 from bash:
echo test | mail
postfix flush
mailq
- Using SNMP Traps:
Default SNMP traps are available under /etc/alertd/alert.conf
User Configured Alerts are set up here: /config/user_alert.conf
NEVER change the default SNMP traps file – /etc/alertd/alert.conf
The following default SNMP trap for pool member going down/up has been copied from the /etc/alertd/alert.conf file and then copied to /config/user_alert.conf file
cat /config/user_alert.conf will provide the following result:
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS {
snmptrap OID=”.1.3.6.1.4.1.3375.2.4.0.10″;
email toaddress=”f5notifications@gmail.com”
fromaddress=”root”
body=”Member Status Change Notification – DOWN”
}
alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP {
snmptrap OID=”.1.3.6.1.4.1.3375.2.4.0.11″;
email toaddress=”f5notifications@gmail.com”
fromaddress=”root”
body=”Member Status Change Notification – UP”
}
In the above alerts, “email toaddress” has been changed to the email address that is expected to receive the alerts from F5.
“fromaddress” is F5’s email address. Leave this at default settings “root”
“body” can be set to any information that needs to be conveyed.
After making the above changes, restart the alertd daemon from bigip bash & save the configuration:
bigstart restart alertd
b load
b save
In the above example, if you want to create customer alerts based on the logs: /var/log/ltm:
alert "" {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.XXX"
}
In the above configuration, “log message” can be obtained from /var/log/ltm that you want to match in order to trigger the email. The SNMP trap OID with “xxx” at the end has to have a number greater than 300 for customer SNMP alerts for F5.
Gotchas:
Make sure to create relevant PTR record for the F5 in order to prevent the emails from being marked as SPAM
Emails can sometimes get queued for a long time on the F5 and consume all the memory on the F5. In order to prevent this, the “queue_minfree” has to be changed to something else from the default zero:
Default is no memory limitation:
# postconf -d | grep queue_minfree
queue_minfree = 0
10M Bytes of storage is provided by the following command:
# echo “queue_minfree = 10000000” >> /etc/postfix/main.cf postconf -e “queue_minfree = 10000000”
Reference: