Network Management
F5 devices generating Info logger Events after enabling iControl monitoring in the SolarWinds Platform
In this article, you will learn to know the root cause of the Info logger events and how to resolve these events, which are been generated by F5 devices after enabling iControl monitoring in the SolarWinds Platform.
First published date
Last published date
Overview
You followed the requirements to monitor the F5 device for iControl in the SolarWinds Platform:
Network Insight for F5 BIG-IP load balancers in NPM (solarwinds.com)
Create an iControl account for F5 monitoring in NPM (solarwinds.com)
After enabling iControl monitoring for F5, a large number of Syslog events are generated, and these messages are being logged into your Syslog server.
log messages similar to the following examples
Informational Events
info logger: [ssl_acc] ssl_acc and ssl_req
Info logger [ssl_acc]"/mgmt/tm/ltm/monitor/wmi/~Common~wmi/status" 404 xx.xx.xx.xx - X_new_Cattools Info logger [ssl_acc]"/mgmt/tm/ltm/monitor/wap/~Common~wmi/status" 404 xx.xx.xx.xx - X_new_Cattools
Product section
Cause
When users navigate the Configuration utility or the F5 services iControl requests, the F5 system's Apache service generates ssl_acc and ssl_req messages on each inbound request. Beginning in F5 11.0.0, the system suppresses these messages from being logged locally. However, the messages are not suppressed when the F5 system is configured to log to remote syslog servers.
As a result, remote log servers may log excessive numbers of log messages hence the F5 is started generating these Events,
SolarWinds monitors the health and performance of all components of application delivery including WideIPs, virtual servers, pool members, and more. and try to get all available monitors from the device, these messages also could be generated if F5 device fails for some specific monitor when requested by SolarWinds iControl monitoring API,
This article describes how to use the SolarWinds Rest Walker diagnostic tool to find out which monitor is failed with 404,
How to use SolarWinds REST Walker
When running REST Walker you will also notice 404 Errors
For Example :
https://xx.xx.xx.xx/mgmt/tm/ltm/monitor/http/~xxxxxxx~Shared~f5__http_8080/stats
Executing request: mgmt/tm/ltm/monitor/diameter/~Common~diameter/stats ERROR: Request for https://xx.xx.xx.xx/mgmt/tm/ltm/monitor/diameter/~Common~diameter/stats executed with HTTP Status: Not Found (404) Executing request: mgmt/tm/ltm/monitor/dns Executing request: mgmt/tm/ltm/monitor/dns/~Common~dns/stats ERROR: Request for https://xx.xx.xx.xx/mgmt/tm/ltm/monitor/dns/~Common~dns/stats executed with HTTP Status: Not Found (404) Executing request: mgmt/tm/ltm/monitor/external Executing request: mgmt/tm/ltm/monitor/external/~Common~external/stats ERROR: Request for https://xx.xx.xx.xx/mgmt/tm/ltm/monitor/external/~Common~external/stats executed with HTTP Status: Not Found (404)
If the monitor is not attached to a pool or is attached to a pool without actual members, it will not show any stats and F5 will respond with a "404 object not found". and this is expected and common.
Resolution
Resolution in SolarWinds Platfomr:
In the SolarWinds Platform you can only reduce the number of requests for not used Monitor types by setting IgnoredMonitorTypes.
You can define unused monitor types in Centralized settings (http://localhost/Orion/Admin/AdvancedConfiguration/Global.aspx),
Setting IgnoredMonitorTypes.
Such types will be ignored during polling.
http://my_Orion_Server/orion/admin/advancedconfiguration/global.aspx
(Example screenshot)
Add the filter, (Example filter and screenshoot is mentioned below)
NONE,diameter,dns,external,firepass,ftp,gateway-icmp,http,http2,https,icmp,imap,inband,ldap,module-score,mqtt,mssql,mysql,nntp,oracle,pop3,postgresql,radius,radius-accounting,real-server,rpc,sasp,scripted,sip,smb,smtp,snmp-dca,snmp-dca-base,soap,tcp,tcp-echo,tcp-half-open,udp,virtual-location,wap,wmi
Save the changes.
If any other monitor fails you can add in this ignore list.
Please Note: Currently we only have global filter available , Filter based on individual node is already included as a Feature Request .
Resolution in F5
With the F5 system, you can configure the level of information that the system logs for events related to Traffic Management.
You can configure the F5 system to suppress sending SSL access (ssl_acc) and request (ssl_req) messages to remote syslog servers.
Log levels related to Traffic Management events
Traffic Management events use levels to distinguish the severity of the event. Traffic Management uses these severity levels when designating log levels. Log levels set the threshold at which Traffic Management event messages start accruing in the log files. Traffic Management event messages equal to and greater than the specified log level are written to the log file. For example, if you specify a log level of Warning, the system writes events classified as Warning, Error, Critical, Alert, and Emergency to the log file.
You are referred to the following vendor's KB's articles.
Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any
Configuring the BIG-IP system to suppress sending SSL access and request messages to remote syslog servers (f5.com)
Configuring the level of information logged for Traffic Management-related events (f5.com)
To Turnoff the logger logs on the remote server - DevCentral (f5.com)