Monitoring

F5 BIG-IP Monitoring

Introduction to F5 BIG-IP Monitoring

F5's BIG-IP is a family of products covering software and hardware designed around application availability, access control, and security solutions. ​Using LogicMonitor's F5 BIG-IP package, you can monitor fan speed, failover state, virtual server metrics, RAM caching metrics, file system utilization, and more.

Setup Requirements

Import LogicModules

From the LogicMonitor Repository, import all F5 BIG-IP LogicModules, which are listed in the LogicModules in Package section of this support article.

Note: In addition to DataSources, there is an SNMP SysOID Map for F5 that must also be imported into your LogicMonitor portal. This LogicModule is responsible for identifying and tagging F5 hosts.

Add Devices Into Monitoring

Add your BIG-IP devices into monitoring. For more information on adding resources into monitoring, see Adding Devices.

Create Device Groups

By default, LogicMonitor does not discover (and therefore monitor) the virtual servers on a BIG-IP load balancer (all other health characteristics such as CPU, memory, network interface statistics, synchronization status, etc. are discovered and monitored). This is because, within a cluster setup, the backup node in an active/backup cluster does not know the health of the virtual servers.

In order to monitor the virtual servers and virtual server pools in your BIG-IP cluster, you'll need to create two device groups for the cluster: one group will contain all nodes in the cluster and the other group contains only the current active node. The active node is identified via the use of a "floating" IP address (i.e. a self IP address in F5 nomenclature), which always remains with the active node in the cluster.

For example, consider that the following DNS names are present in a BIG-IP cluster:

  • bigip-node1.mycompany
  • bigip-node2.mycompany
  • bip.mycompany.com

In this example, bip.mycompany.com is the floating IP address and should be added into monitoring as other BIG-IP devices. Continuing with this example, these DNS names should be organized into the following two device groups within LogicMonitor:

Device Group: All BIG-IP Nodes

Device Group: Active BIG-IP Node

bigip-node1.mycompany
bigip-node2.mycompany
bip.mycompany.com

For more information on creating device groups, see Adding Device Groups.

The device group that contains the floating IP address (the "Active BIG-IP Node" group in our example) requires that a value of "F5Active" be added to its system.categories property. Be sure to add this value at the group level, not device level. This will allow those DataSources only relevant to virtual server monitoring to only apply to the current active node. For instructions on adding properties, see Device Properties.

Enable SNMP on the BIG-IP Appliance

LogicMonitor uses SNMP to query BIG-IP appliances for metrics. ​SNMP must be configured on the BIG-IP appliance, which supports SNMPv1, SNMPv2, and SNMPv3. Refer to the F5 Networks Configuration Guide for BIG-IP Access Policy Manager for instructions on configuring SNMP.

Enter SNMP Credentials into LogicMonitor

The LogicMonitor Collector must provide the appropriate SNMP credentials in order to successfully access the BIG-IP appliance. This requires adding these credentials as properties on the resource within the LogicMonitor interface. As discussed in Defining Authentication Credentials, the SNMP properties that must be set vary depending upon the version of SNMP in use.​ ​

Considerations: Migration from Legacy F5 BIG-IP DataSources

In October of 2019, LogicMonitor released a new set of F5 BIG-IP DataSources. If you are currently monitoring BIG-IP using the legacy DataSources, you will not experience any data loss upon importing the newer DataSources in this package. This is because DataSource names have been changed to eliminate module overwriting.

However, you will collect duplicate data and receive duplicate alerts for as long as both sets of DataSources are active. For this reason, we recommend that you disable the legacy F5 BIG-IP DataSources, listed next:

  • F5_BigIP_SystemFailoverStatus (not to be confused with the new "F5_BigIP_FailoverStatus" DataSource)
  • F5Cache-
  • F5Compression-
  • F5Disk-
  • F5Fan-
  • F5HA-
  • F5If-
  • F5Pools-
  • F5Power-
  • F5system
  • F5_SSL_VIP_Certs
  • F5Temp-
  • F5_TMM-
  • F5_VIP-

Note: All new F5 DataSource names are prefixed with "F5-BigIP".

When a DataSource is disabled, it stops querying the host and generating alerts, but maintains all historical data. At some point in time, you may want to delete the legacy DataSources altogether, but consider this move carefully as all historical data will be lost upon deletion. For more information on disabling DataSources, see Disabling Monitoring for a DataSource or Instance. ​

Troubleshooting

​DataSources will print error messages to the console when present. These errors can be seen on the Resources page (from the Raw Data tab of a DataSource/instance). DataSources are designed to handle errors gracefully and will attempt to grab any available data even when errors occur. ​

LogicModules in Package

LogicMonitor's package for F5 BIG-IP consists of the following LogicModules. For full coverage, please ensure that all of these LogicModules are imported into your LogicMonitor platform.

Display Name

Type

Description

F5 Category SNMP SysOID Map Identifies and tags F5 hosts.
F5 Cache DataSource Monitors RAM Caching Metrics.
F5 Compression DataSource Monitors MIME Data compression metrics.
F5 Failover Status DataSource Monitors Failover State and System Status.
F5 Fans DataSource Monitors Fan Speed and Health.
F5 Filesystem DataSource Monitors Filesystem sizes/utilization and Block/Node availability.
F5 High Availability DataSource Monitors High Availability Status for F5 Cluster.
F5 Interfaces DataSource Monitors inbound/outbound traffic on Networking Interfaces.
F5 Memory DataSource Monitors Memory Utilization.
F5 Pool State DataSource Monitors Pool Member metrics and states.
F5 Power DataSource Monitors system power states.
F5 VIP SSL Certs DataSource Monitors SSL Certificate Expiration Dates.
F5 Global Statistics DataSource Monitors overall system health and performance.
F5 Traffic Management Microkernel DataSource Monitors Traffic Management Microkernel (TMM) metrics.
F5 Temperature DataSource Monitors system temperature (in Celsius).
F5 VIP Statistics DataSource Monitors Virtual Server Metrics.
F5 Pool Member Statistics DataSource Monitors overall health and performance for individual Pool Members.

When setting alert thresholds on the various metrics tracked by this package, LogicMonitor follows the technology owner's best practice KPI recommendations. If necessary, we encourage you to adjust these predefined thresholds to meet the unique needs of your environment. For more information on tuning alert thresholds, see Tuning Alert Thresholds for Datapoints.