Monitoring ASM System Resources

Collecting ASM resource and health statistics

This implementation describes how to set up the BIG-IP system to collect Application Security Manager™ (ASM) resource usage and send alerts when the system has surpassed threshold usage. These alerts allow you to troubleshoot any system resource limitations that can impact ASM performance. You can specify the resources monitored and the thresholds that you want the system to use, or let the system send alerts about your selected resources based on default settings. You can also specify whether these alerts are sent over the local system log, SNMP or SMTP (email) when a threshold is surpassed and when the threshold is then below the set value.

Configuring ASM health and resource alerts

To set up email alerts you must specify an SMTP configuration. If you have not already done so, you can click Create in the SMTP Configuration field.

Monitoring aspects of system resource usage can assist in system troubleshooting and prevent long-term ASM performance issues. You can configure which system resources and corresponding thresholds trigger your alert notifications, and where these notifications can be logged or sent.

1. On the main tab, click Security > Reporting > Settings > ASM Alerts.

   The ASM Alerts screen opens.

2. Select the Enabled checkbox to receive alerts when that system resource exceeds its threshold.

   In the Threshold field of each resource, adjust the threshold according to your system monitoring needs.

3. If you want the system to send email notifications, review the SMTP Configuration field to ensure that a configuration is specified and not the value None.

   You can configure SMTP only in the default Analytics profile. If it is not configured, you can save the profile and edit the default profile where you can select an existing SMTP configuration or create a new one. (If you click the analytics link without saving the new profile you are working on, you will lose the unsaved changes.)

4. For the Notification Type setting, select how you want the system to send alerts and notifications.

   Type	Description
   Syslog	Select Syslog if you want the system to send notification and alert messages to the local log system. You can view the messages on the System > Logs > Local Traffic screen.
   SNMP	Select SNMP if you want the system to send notification and alert messages as SNMP traps. You can create the trap by clicking Configuration can be found here ( System > SNMP > Traps > Destination). Enabling SNMP automatically sets up Syslog notifications, too.
   E-mail	Select E-mail if you want the system to send notification and alert messages to email addresses. Type each email address in the Notification E-Mails field, and click Add to create the list. This option requires that the default analytics profile includes an SMTP configuration.

   When you select a notification type, the screen displays the Alerts and Notifications Configuration area, where you can indicate the criteria for alerts and notifications.

5. Click Update save your alert settings.

Enabling alerts has a minimal performance impact when all alerts are enabled.

Note: Immediately following configuration, you may receive an alert notification that the system had surpassed a low value threshold. You may disregard this initial notification.

ASM System Resources

You can receive alerts for Application Security Manager (ASM) system resources when system these resources pass a defined usage thresholds. This table provides an overview of the system resources used directly, or indirectly, by ASM. Alert notifications reflect the average system values, per blade, collected over the past minute. These alerts allow you to mitigate resource usage that impacts ASM performance. For sustained alerts, you may need to adjust your memory configuration, virtual server configuration, or add a new device. For assistance, contact F5 Support.