Sending F5 BIG-IP Alerts to Telegram/Discord

Sending alerts from an F5 Big IP device is not so similar to doing it from a vCenter Server Appliance. The major difference is that it has its own config file to deal with alerts.

The config file is /config/user_alert.conf and you can put custom rules in it. Also the log file /var/log/ltm stores events that could be used to send alerts. F5 Big IP will determine what kind of alert it is based on each new entry arrived. The following screenshot shows part of a sample log.

The log entries show different levels like info, notice, and err (not shown there).

What we need to deal with are entries with info status. So after referencing the log file and references like link 2 at the end of the article I came up with my own version of /config/user_alert.conf. Shown below.

alert BIGIP_TMM_TMMERR_LAST_PMBR_DOWN {
exec command="/shared/tmp/send-alert-new BODY1";
}

alert BIGIP_TMM_TMMERR_PMBR_BACK_UP {
exec command="/shared/tmp/send-alert BODY2";
}

alert BIGIP_MCPD_MCPDERR_VIRTUAL_UNAVAIL {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.136";
exec command="/shared/tmp/send-alert-new BODY3";
}

alert BIGIP_MCPD_MCPDERR_VIRTUAL_AVAIL {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.135";
exec command="/shared/tmp/send-alert BODY4";
}

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.10";
exec command="/shared/tmp/send-alert BODY5";
}

alert BIGIP_MCPD_MCPDERR_POOL_MEMBER_MON_STATUS_UP {
snmptrap OID=".1.3.6.1.4.1.3375.2.4.0.11";
exec command="/shared/tmp/send-alert BODY6";
}

And my script with minor modifications is shown as follows for sending alerts to a Discord channel.

#!/bin/bash

MSG=`grep notice ltm-2 | tail -1 | sed 's/\n/ *** /'`

HEADER="**F5 Alert!!!**"

### To be combined with /config/user_alert.conf
BODY1="Pool has no available pool members."
BODY2="Pool now has available pool members."
BODY3="A virtual server has stopped processing traffic."
BODY4="A virtual server has resumed processing traffic."
BODY5="A pool member health check has failed."
BODY6="A pool member has recovered from a failed health check."

WEB_HOOK=https://discord.com/api/webhooks/12452121972615XXXXX/ht4ZiRUEFYbgQ4YDU9mUl1rtcdLsNGVFB95XW_UKIICd5Xppf-QvwzlMEqn-rMcXXXXX

send_discord() {

MSG="${HEADER} ${!1} \nLog message(s) below:\n$MSG"
curl -H "Content-Type: application/json" -d "{\"content\": \"$MSG\"}" $WEB_HOOK

}

send_discord $1

The following is a sample screenshot.