F5 BIG-IP Monitoring
Last updated on 17 March, 2023Overview
F5’s BIG-IP is a family of products covering software and hardware designed around application availability, access control, and security solutions. Using LogicMonitor’s F5 BIG-IP package, you can monitor fan speed, failover state, virtual server metrics, RAM caching metrics, file system utilization, and more.
Setup Requirements
Import LogicModules
From the LogicMonitor Repository, import all F5 BIG-IP LogicModules, which are listed in the LogicModules in Package section of this support article.
Note: In addition to DataSources, there is an SNMP SysOID Map for F5 that must also be imported into your LogicMonitor portal. This LogicModule is responsible for identifying and tagging F5 hosts.
Add Devices Into Monitoring
Add your BIG-IP devices into monitoring. For more information on adding resources into monitoring, see Adding Devices.
Create Device Groups
By default, LogicMonitor does not discover (and therefore monitor) the virtual servers on a BIG-IP load balancer (all other health characteristics such as CPU, memory, network interface statistics, synchronization status, etc. are discovered and monitored). This is because, within a cluster setup, the backup node in an active/backup cluster does not know the health of the virtual servers.
In order to monitor the virtual servers and virtual server pools in your BIG-IP cluster, you’ll need to create two device groups for the cluster: one group will contain all nodes in the cluster and the other group contains only the current active node. The active node is identified via the use of a “floating” IP address (i.e. a self IP address in F5 nomenclature), which always remains with the active node in the cluster.
For example, consider that the following DNS names are present in a BIG-IP cluster:
- bigip-node1.mycompany
- bigip-node2.mycompany
- bip.mycompany.com
In this example, bip.mycompany.com is the floating IP address and should be added into monitoring as other BIG-IP devices. Continuing with this example, these DNS names should be organized into the following two device groups within LogicMonitor:
| Device Group: All BIG-IP Nodes | Device Group: Active BIG-IP Node |
| bigip-node1.mycompany bigip-node2.mycompany | bip.mycompany.com |
For more information on creating device groups, see Adding Device Groups.
The device group that contains the floating IP address (the “Active BIG-IP Node” group in our example) requires that a value of “F5Active” be added to its system.categories property. Be sure to add this value at the group level, not device level. This will allow those DataSources only relevant to virtual server monitoring to only apply to the current active node. For instructions on adding properties, see Resource and Instance Properties.
Enable SNMP on the BIG-IP Appliance
LogicMonitor uses SNMP to query BIG-IP appliances for metrics. SNMP must be configured on the BIG-IP appliance, which supports SNMPv1, SNMPv2, and SNMPv3. Refer to the F5 Networks Configuration Guide for BIG-IP Access Policy Manager for instructions on configuring SNMP.
Enter SNMP Credentials into LogicMonitor
The LogicMonitor Collector must provide the appropriate SNMP credentials in order to successfully access the BIG-IP appliance. This requires adding these credentials as properties on the resource within the LogicMonitor interface. As discussed in Defining Authentication Credentials, the SNMP properties that must be set vary depending upon the version of SNMP in use.
Considerations: Migration from Legacy F5 BIG-IP DataSources
In October of 2019, LogicMonitor released a new set of F5 BIG-IP DataSources. If you are currently monitoring BIG-IP using the legacy DataSources, you will not experience any data loss upon importing the newer DataSources in this package. This is because DataSource names have been changed to eliminate module overwriting.
However, you will collect duplicate data and receive duplicate alerts for as long as both sets of DataSources are active. For this reason, we recommend that you disable the legacy F5 BIG-IP DataSources, listed next:
- F5_BigIP_SystemFailoverStatus (not to be confused with the new “F5_BigIP_FailoverStatus” DataSource)
- F5Cache-
- F5Compression-
- F5Disk-
- F5Fan-
- F5HA-
- F5If-
- F5Pools-
- F5Power-
- F5system
- F5_SSL_VIP_Certs
- F5Temp-
- F5_TMM-
- F5VIP-
Note: All new F5 DataSource names are prefixed with “F5_BigIP”.
When a DataSource is disabled, it stops querying the host and generating alerts, but maintains all historical data. At some point in time, you may want to delete the legacy DataSources altogether, but consider this move carefully as all historical data will be lost upon deletion. For more information on disabling DataSources, see Disabling Monitoring for a DataSource or Instance.
Troubleshooting
DataSources will print error messages to the console when present. These errors can be seen on the Resources page (from the Raw Data tab of a DataSource/instance). DataSources are designed to handle errors gracefully and will attempt to grab any available data even when errors occur.
LogicModules in Package
LogicMonitor’s package for F5 BIG-IP consists of the following LogicModules. For full coverage, please ensure that all of these LogicModules are imported into your LogicMonitor platform.
When setting static datapoint thresholds on the various metrics tracked by this integration package, LogicMonitor follows the technology owner’s best practice KPI recommendations. If necessary, we encourage you to adjust these predefined thresholds to meet the unique needs of your environment. For more information on tuning datapoint thresholds, see Tuning Static Thresholds for Datapoints.