Monitoring, Logging, Troubleshooting, and Maintenance
Domain 8 - Monitoring, Logging, Troubleshooting, and Maintenance
This domain tests whether you can prove a component is healthy, find the right log, and maintain the platform without breaking it.
Monitors and health
A monitor sends a probe and interprets the response. Common types include ICMP, TCP, TCP half-open, HTTP, HTTPS, and custom scripted monitors. Interval is how often the probe runs; timeout is how long to wait; send and receive strings define the expected exchange. A member is up only if the monitor succeeds. Manual resume can hold a member down after recovery. Monitors attach to nodes or members; a node monitor affects all members on that node.
Logs and tools
Key logs include /var/log/ltm for LTM events, /var/log/asm, /var/log/apm, /var/log/audit, and /var/log/restjavad. Use tmsh show ltm virtual, show ltm pool, and show ltm pool members for state. tcpdump on a VLAN or interface shows packets; curl and openssl s_client test HTTP and TLS; dig tests DNS. qkview collects diagnostics for support.
Worked example
Users report 503s from a virtual server. tmsh show ltm pool webpool shows all members down. The HTTP monitor sends 'GET /health HTTP/1.1' with a Host header, but the application now returns 404 for /health. The monitor marks members down, so the virtual server has no available member. Fix the monitor to expect 200 and a valid receive string, or correct the application endpoint. The root cause is the monitor mismatch, not the load-balancing method.
Maintenance
Take a UCS backup before changes. Upgrade through a supported path; check version compatibility and configuration sync afterward. License reactivation and certificate expiry are common planned-work items. Do not troubleshoot by rebooting first; gather state.
Traps
- Reading only /var/log/ltm when the issue is ASM or APM.
- Confusing monitor interval with timeout.
- Assuming a pool member is down because the node is down; check member and node state separately.
- Editing a monitor template when the object uses a different inherited monitor.
- Running tcpdump without a filter on a busy system.
- Rebooting before collecting qkview or logs and losing the evidence.