Monitoring, Troubleshooting, and Logging
This domain tests the operational toolset: show and stat commands, nsconmsg, packet capture, syslog, audit logging, AppFlow, and ADM. The exam expects a structured troubleshooting sequence rather than random commands.
Core rules
- Show commands display configuration and state, such as show lb vserver, show service, and show monitor. Stat commands display counters, such as stat lb vserver.
- Monitor status explains why a service is down. Check the monitor type, destination, expected response, and retries before capturing packets.
- nsconmsg reads newnslog for historical performance counters. nstrace captures packets with filters, and nstcpdump.sh provides a quick capture.
- Syslog sends event messages to external collectors. The audit log records configuration changes. AppFlow exports IPFIX records to ADM or other collectors. SNMP traps alert on events.
- A tech support bundle collects configuration and logs for support. The NITRO API supports automation and monitoring.
Worked example
Users report HTTP 503 from a VIP. Check show lb vserver: the virtual server is up. Check show service: all services are down. The monitor is HTTP-ECV expecting HTTP 200, but the application now returns HTTP 302 after login. The health check therefore fails. Change the monitor to accept 200 through 399, or point it at a dedicated health endpoint that returns 200. The reasoning is that the virtual server state reflects service health, and the monitor definition caused a false negative; packet capture would have shown the 302 only after this state check.
Traps that cost marks
Relying only on the dashboard hides service-level state. Show service and show servicegroup display different objects. Syslog and AppFlow are not enabled by default. nstrace files can grow large and affect performance, so use filters and stop the capture. Tech support bundles can contain sensitive data. In an HA pair, check logs and states on both nodes. A monitor failure is a control-plane issue; do not start with a packet capture unless state and monitor checks are inconclusive.