Network Management

F5 virtual servers sometimes go into unknown status

This article covers F5 Virtual Servers may go into an unknown status when polling them using NPM 12.2 or later versions that contains new F5 pollers.

First published date

10/28/2018 9:25 PM

Last published date

4/20/2022 7:29 AM

Overview

There are cases where F5 virtual servers may go into unknown status due to a potential device issue related where the OID for F5 virtual servers shows a different value than what is shown on the device.

Product section

Network Performance Monitor

Cause

Potential device issue.

Resolution

To determine if this is also a device issue, you should capture an snmpwalk as follows:

  1. Choose one of the nodes, where the issue is usually visible.
  2.  Create an advance alert for the selected node that will trigger when the issue appears (F5 virtual servers go into unknown).
  3. Set up the Wireshark Capture Options:  - Capture Filter: udp port 161 and host <selected node IP_address>  - specify .File name  - select "Next file every" and specify the file size  - select "Ring buffer with" and set the value to 2.
  4. Start capturing.
  5. When the alert is triggered, both pcaps.
  6. In the .pcap file, you can may find that we don't get a response when we ask for an OID such as 1.3.6.1.4.1.3375.2.2.10.14.2.1.3.
  7. Since we need the results from this OID and others in the poll, the whole poll will be marked as timed-out. It may not only this OID but it maybe that the device does not respond for a while on all our requests.
Steps to check for no response from device
  1. Open the pcap.
  2. Set filter ip.addr==X.X.X.X (IP of device).
  3. Sort the results by time.
  4. If there is no response from Date Time to Date Time of issue.
  5. You should send these on to the vendor, F5 for investigation as SolarWinds support will confirm with such findings that this is a device issue.