• Understanding the Health Model
• Alerts and the F5 Monitoring Log

Note: This documentation was adapted from the F5 Management Pack Wiki hosted on DevCentral (http://devcentral.f5.com/wiki/MgmtPack.HomePage.ashx). Certain links or context described in this document may refer to content originally created on the Wiki.

Understanding the Health Model

This document describes the health model for the F5 Monitoring Pack monitoring service. The health model consists of a set of monitors, alerts, and event log entries which provide detailed information regarding the health of the service. The Operations Manager Health Explorer can be used to view the monitors associated with the service. The Operations Manager Alert View can be used to view the alerts. The Windows Event Log can be used to view event log entries. See BIG-IP Health Model for F5 Monitoring Pack to view the list of objects in the health model.

Using the Health Explorer

In Operations Manager 2007, you can use the Health Explorer tool to define and diagnose failures on your network. Health Explorer gives you the ability to view and then take action on alerts, state changes, and other significant issues generated by monitoring objects on your network. You can start Health Explorer from the Actions pane after you select an object, alert, or event in the results pane. Health Explorer organizes health information into the following categories:

• Performance
• Security
• Availability
• Configuration

All monitors and rules that are defined for a selected object display in the appropriate category. By default, when the Health Explorer windows first opens, all monitors that are in a failed, or red, state appear expanded. If a monitor contains other monitors, as in the case of a roll-up monitor, all monitors are shown in a hierarchical layout so that monitoring data for all dependent services and applications is displayed. If you want to view more detail on any dependent monitor, you can right-click that monitor and then click Monitor Properties to open another Health Explorer window. When the Health Explorer window is open, you can review a history of diagnostic tests that have run automatically and the output from those tasks. You can also run additional diagnostic tasks. Any task that is formatted as a hyperlink can run directly from the Knowledge tab. The Health Explorer window refreshes automatically every 30 seconds. You can press the F5 function key for an immediate refresh.

Understanding Monitors

The following list include monitors available in the F5 Monitoring Pack that target the F5 Monitoring Service. Certain monitors contain child objects or counters, and the top-level monitors present a summary status based on the worst case status of any child object or counter.

Availability monitors

• F5 Monitoring Pack Monitoring Service Monitor: This monitor indicates whether the F5 Monitoring Service is running
• Data Layer: All the connection pool monitors listed below appear unhealthy when any of their connections are unable to connect.
  • F5 Networks Monitoring Pack Database
    • F5 Networks Monitoring Pack Database Connection Pool: Detects when there is a problem with the connectionn to the local F5 Monitoring Pack database
  • Operations Manager Connections
    • Data Source Server: Detects when a necessary assembly has not been loaded in Operations Manager or either of the server components are not responding
    • Operations Manager Connector: Detects when there is a problem with the connection to the Operations Manager SDK service
    • Operations Manager Event Data Source: Detects when there is a problem with the connection to the Operations Manager Event Data Source
    • Operations Manager Performance Data Source: Detects when there is a problem with the connection to the Operations Manager Performance Data Source
      

Configuration Monitors

• Service Configuration: This monitor detects problems with the F5 Monitoring Service configuration
  

Performance Monitors

• Configuration
  • Configuration update processing time: Detects updates that require more than two (2) minutes
  • Configuration updates per second: Detects when an unsupported level of configuration updates are being received
  • Event Data Source Backlog: Detects when the backlog is too high
  • Event Data Source time to post: Detects when the average time to post is too high
    

• Statistics Processing
  • Performance Data Source backlog: Detects when the backlog is too high.
  • Performance Data Source time to post: Detects when the average time to post is too high.
  • Stats dropped by Operations Manager: Detects when Operations Manager logs a warning that statistics are being dropped.
  • Statistics received per second: Detects when an unsupported number of statistics per second are being received.
    
    

Viewing the Health Model using the Operations Console

You can open the Health Explorer for any managed device from the results pane for any Active Alert, Diagram View, State View, or from an event.

Using the Health Explorer

• In the results pane, click the name of the instance for which you want to view network health.
• In the Actions pane, click the Health Explorer for link where is the name of the device, object, alert, or event you selected.The Health Explorer window opens.
• In the Health Monitors column, click a health counter for more information.When you click certain counters, information appears in the Knowledge tab that can help you gain insight into network health.
  

Most top-level health counters reflect a summary health state of related counters and objects. To view details of specific counters, you can expand the view of summary counters.

Alerts and the F5 Monitoring Log

In addition to the monitors available in the Health Explorer, there are many conditions whereby event log entries will be created in the F5 Monitoring Log. This log can be accessed using the Windows Event Log Viewer.

When these event log entries are created, alerts will be fired in Operations Manager which can be managed using the Active Alerts viewer or Alert View for the Monitoring Pack Sevice.

Alert and Event Log Listing

These are all rules which generate alerts. Alerts do not return to a healthy state; they are simply fired.

Alert/Trigger

• Unhandled exception thrown in DataSource? server F5 Event 405
• Ops Mgr data warehouse connection failed F5 Event 409
• MP DB Data was found to be corrupted F5 Event 406
• MP DB SQL Error encountered F5 Event 407
• Unable to write to trace source F5 Event 600
• Windows Performance counter missing F5 Event 601
• iQuery - Malformed XML discarded F5 Event 700
• iQuery - Properly formed but semantically unusable XML discarded ( such as ) F5 Event 701
• iQuery - Big3D? returned an error tag ( ... ) in a config response F5 Event 702
• iQuery - Unknown element found in otherwise valid configuration or stats xml F5 Event 703
• iQuery - Could not find Monitoring ID corresponding to a config update F5 Event 704
• iQuery - Incoming iQuery message was unable to be fully processed (potentially due to an error already listed) F5 Event 705

Contacting F5 Networks

For additional information, please visit http://www.f5.com.