Updated Date: 11/03/2026
Health Assessment Script Inventory
This reference documents the complete inventory of heuristic scripts included in the F5OS Platform Health Assessment Suite, the JSON output contract that all scripts follow, and the script registration model.
For general information about the health assessment suite, see F5OS Platform Health Assessment Suite overview.
Script IDs use a role prefix that identifies which platform role the script applies to:
| Prefix | Role group | Directory | Example |
|---|---|---|---|
A##### |
Appliance | appliance/ |
A10021_check_network_mgr.pyh |
B##### |
Blade | blade/ |
B00012_check_network_mgr.pyh |
C##### |
Controller | controller/ |
C00101_etcd_health.pyh |
S##### |
Shared (role-agnostic) | shared/ |
S00012_certificate_store_monitor.pyh |
| ID | Script |
|---|---|
A10003 |
A10003_atse_register_dump.pyh |
A10006 |
A10006_drop_counters.pyh |
A10007 |
A10007_error_counters.pyh |
A10008 |
A10008_throughput_counters.pyh |
A10010 |
A10010_memory_check.pyh |
A10011 |
A10011_f5os_error_log_search.pyh |
A10012 |
A10012_pci_check.pyh |
A10013 |
A10013_docker_network_utilization.pyh |
A10014 |
A10014_file_system_utilization.pyh |
A10015 |
A10015_disk_io_utilization.pyh |
A10016 |
A10016_cpu_utilization.pyh |
A10017 |
A10017_process_cpu_utilization.pyh |
A10018 |
A10018_docker_cpu_utilization.pyh |
A10019 |
A10019_docker_memory_utilization.pyh |
A10020 |
A10020_process_memory_utilization.pyh |
A10021 |
A10021_check_network_mgr.pyh |
A10022 |
A10022_lacp_health_check.pyh |
A10023 |
A10023_platform_memory_utilization.pyh |
| ID | Script |
|---|---|
B00010 |
B00010_pci_check.pyh |
B00011 |
B00011_inter_fpga_link_scan.pyh |
B00012 |
B00012_check_network_mgr.pyh |
| ID | Script |
|---|---|
C00002 |
C00002_controller_state.pyh |
C00003 |
C00003_verify_trunks.pyh |
C00004 |
C00004_verify_lacp_members.pyh |
C00010 |
C00010_check_network_mgr.pyh |
C00011 |
C00011_lop_health.pyh |
C00012 |
C00012_time_sync.pyh |
C00020 |
C00020_controller_sensor_health.pyh |
C00100 |
C00100_k8s_cluster_health_check.pyh |
C00101 |
C00101_etcd_quorum_health.pyh |
C00103 |
C00103_partition_certificate_monitor.pyh |
C00104 |
C00104_partition_lacp_health_check.pyh |
C00106 |
C00106_drbd_split_brain_health.pyh |
C01001 |
C01001_blade_state.pyh |
C01002 |
C01002_blade_pci_check.pyh |
C01003 |
C01003_inter_fpga_link_scan.pyh |
C01004 |
C01004_blade_drop_counters.pyh |
C01005 |
C01005_blade_error_counters.pyh |
C01006 |
C01006_file_system_utilization.pyh |
C01007 |
C01007_disk_io_utilization.pyh |
C01008 |
C01008_cpu_utilization.pyh |
C01009 |
C01009_process_cpu_utilization.pyh |
C01010 |
C01010_docker_cpu_utilization.pyh |
C01011 |
C01011_docker_memory_utilization.pyh |
C01012 |
C01012_process_memory_utilization.pyh |
C01013 |
C01013_vqf_voq_health.pyh |
C01014 |
C01014_chassis_upgrade_state.pyh |
C01016 |
C01016_platform_memory_utilization.pyh |
C01018 |
C01018_controller_switch_counters.pyh |
C01019 |
C01019_backplane_fabric_health.pyh |
C01020 |
C01020_partition_interface_state.pyh |
C10003 |
C10003_memory_check.pyh |
| ID | Script |
|---|---|
S00002 |
S00002_platform_monitor_health.pyh |
S00004 |
S00004_docker_restart_health.pyh |
S00010 |
S00010_memory_health.pyh |
S00011 |
S00011_dmesg_search.pyh |
S00012 |
S00012_certificate_store_monitor.pyh |
S00013 |
S00013_lkrg_health.pyh |
S00015 |
S00015_service_crash_loop.pyh |
S00016 |
S00016_filesystem_health.pyh |
S00017 |
S00017_core_file_accumulation.pyh |
S00019 |
S00019_oom_event_monitor.pyh |
S00020 |
S00020_process_memory_leak.pyh |
S00021 |
S00021_system_health_summary.pyh |
S00022 |
S00022_active_alarms.pyh |
| Script ID | Filename | Alarm Support | Action | Severity | Condition |
|---|---|---|---|---|---|
A10003 |
A10003_atse_register_dump.pyh |
No | — | — | No alarm or event actions |
A10006 |
A10006_drop_counters.pyh |
No | — | — | No alarm or event actions |
A10007 |
A10007_error_counters.pyh |
No | — | — | No alarm or event actions |
A10008 |
A10008_throughput_counters.pyh |
No | — | — | No alarm or event actions |
A10010 |
A10010_memory_check.pyh |
No | — | — | No alarm or event actions |
A10011 |
A10011_f5os_error_log_search.pyh |
No | — | — | No alarm or event actions |
A10012 |
A10012_pci_check.pyh |
Yes | GENERATE_ALARM |
ERROR | Any PCIe speed or width mismatch, or missing device from bus |
A10012 |
A10012_pci_check.pyh |
Yes | GENERATE_EVENT |
ERROR | Per individual mismatched device |
A10012 |
A10012_pci_check.pyh |
Yes | Result | WARN | FPGA bitfile not loaded |
A10012 |
A10012_pci_check.pyh |
Yes | CLEAR_ALARM |
— | All PCIe devices match expected configuration |
A10013 |
A10013_docker_network_utilization.pyh |
No | — | — | No alarm or event actions. Script cleanup needed |
A10014 |
A10014_file_system_utilization.pyh |
No (events only) | GENERATE_EVENT |
ERROR | Filesystem disk-space or inode utilization exceeds error threshold (any averaging window) |
A10014 |
A10014_file_system_utilization.pyh |
No (events only) | Result | WARN | Utilization at or above warn threshold. Script cleanup needed |
A10015 |
A10015_disk_io_utilization.pyh |
No | — | — | No alarm or event actions |
A10016 |
A10016_cpu_utilization.pyh |
No (events only) | GENERATE_EVENT |
ERROR | F5OS CPU active% ≥ 90% (any averaging window) |
A10016 |
A10016_cpu_utilization.pyh |
No (events only) | Result | WARN | CPU active% ≥ 80% |
A10016 |
A10016_cpu_utilization.pyh |
No (events only) | Result | WARN | iowait% ≥ 20% |
A10017 |
A10017_process_cpu_utilization.pyh |
No | — | — | No alarm or event actions |
A10018 |
A10018_docker_cpu_utilization.pyh |
No | — | — | No alarm or event actions |
A10019 |
A10019_docker_memory_utilization.pyh |
No | — | — | No alarm or event actions |
A10020 |
A10020_process_memory_utilization.pyh |
No | — | — | No alarm or event actions |
A10021 |
A10021_check_network_mgr.pyh |
Yes | GENERATE_ALARM |
ERROR | NetworkManager VSZ > 5,000 MB |
A10021 |
A10021_check_network_mgr.pyh |
Yes | GENERATE_EVENT |
ERROR | VSZ > 5,000 MB (with volatile values) |
A10021 |
A10021_check_network_mgr.pyh |
Yes | GENERATE_EVENT |
WARNING | VSZ > 4,000 MB |
A10021 |
A10021_check_network_mgr.pyh |
Yes | CLEAR_ALARM |
— | VSZ ≤ 4,000 MB |
A10022 |
A10022_lacp_health_check.pyh |
Yes | GENERATE_ALARM |
CRITICAL | Any LACP LAG member is not IN_SYNC, or aggregatable/collecting/distributing is false |
A10022 |
A10022_lacp_health_check.pyh |
Yes | GENERATE_EVENT |
CRITICAL | Unhealthy member count across all LAGs |
A10022 |
A10022_lacp_health_check.pyh |
Yes | CLEAR_ALARM |
— | All LACP LAG members are IN_SYNC with aggregatable, collecting, and distributing all true |
A10023 |
A10023_platform_memory_utilization.pyh |
No | Result | WARN | Platform memory used% ≥ 80% (any averaging window: 10s, 1m, 5m, 15m, 60m, 4h, 24h) |
A10023 |
A10023_platform_memory_utilization.pyh |
No | Result | ERROR | Platform memory used% ≥ 90% |
| Script ID | Script Name | Background Polling | Alarm Support | Trigger Conditions | Clear Condition |
|---|---|---|---|---|---|
B00010 |
B00010_pci_check.pyh |
No (covered by C01002) |
Yes | GENERATE_ALARM ERROR — Any PCIe speed or width mismatch; GENERATE_EVENT ERROR — Per mismatched device; Result WARN — FPGA not loaded |
CLEAR_ALARM when all PCIe devices match expected configuration |
B00011 |
B00011_inter_fpga_link_scan.pyh |
No (covered by C01003) |
No | — | — |
B00012 |
B00012_check_network_mgr.pyh |
Yes (hourly) | Yes | GENERATE_ALARM ERROR — NetworkManager VSZ > 5 GB; GENERATE_EVENT WARNING — VSZ > 4 GB |
CLEAR_ALARM when VSZ is within normal range (≤ 4 GB) |
| Script ID | Filename | Background Polling | Alarm Support | Recommendation | Trigger Conditions | Clear Conditions | Failure Conditions |
|---|---|---|---|---|---|---|---|
C00002 |
C00002_controller_state.pyh |
Yes (hourly) | Yes | PLATFORM_REBOOT for the affected controller |
GENERATE_ALARM — Any check fails (SSH / service / network IP); GENERATE_EVENT — Per failed sub-check (SSH / service / network IP) |
CLEAR_ALARM when all pass: ping + SSH + service active + all 3 network IPs reachable. Per-controller independently; no partial clear. |
Any controller ping, SSH, service, or internal-network check fails. |
C00003 |
C00003_verify_trunks.pyh |
Yes (hourly) | Yes | PLATFORM_REBOOT for the affected controller |
GENERATE_ALARM — Any trunk member missing from team0; GENERATE_ALARM + GENERATE_EVENT — All 3 members present but any link.up=false; GENERATE_ALARM — SSH to controller unreachable; GENERATE_EVENT — teamdctl returns empty output |
CLEAR_ALARM when all 3 members present AND all links UP on that controller. Per-controller independent. |
A trunk member is missing or DOWN. |
C00004 |
C00004_verify_lacp_members.pyh |
Yes (hourly) | Yes | PLATFORM_REBOOT for the affected controller |
GENERATE_ALARM — LAG missing, member count ≠ 2, controller member missing, or member not IN_SYNC; GENERATE_EVENT — Any LACP problem exists |
CLEAR_ALARM when all blades have LAGs with exactly 2 members, all IN_SYNC. |
Missing LAG/member, incorrect member count, or member not IN_SYNC. |
C00010 |
C00010_check_network_mgr.pyh |
Yes (hourly) | Yes | — | GENERATE_ALARM ERROR — NetworkManager VSZ > 5 GB; GENERATE_EVENT WARNING — VSZ > 4 GB; GENERATE_ALARM — NetworkManager process not found |
CLEAR_ALARM when VSZ ≤ 4 GB. Per-controller independently. |
— |
C00011 |
C00011_lop_health.pyh |
No | No | — | None | None | Bootloader mode, not responding, invalid connection, USB/UDP absent, POST/runtime faults. |
C00012 |
C00012_time_sync.pyh |
No | No | — | None | None | Failed to query time, no controller times available for time sync check, or time differences detected between controllers. |
C00020 |
C00020_controller_sensor_health.pyh |
No | No | — | None | None | HAL reports a sensor state whose configured severity is ERROR or CRITICAL. |
C00100 |
C00100_k8s_cluster_health_check.pyh |
Yes (hourly) | No (events only) | — | GENERATE_EVENT — Node not Ready, unhealthy system pod, or degraded scheduler |
— | Expected node is Missing/NotReady, assigned node is SchedulingDisabled, system pod is Pending/Failed/Unknown or has a bad waiting reason, or scheduler is degraded. |
C00101 |
C00101_etcd_quorum_health.pyh |
Yes (hourly) | Yes | — | GENERATE_ALARM CRITICAL — Any etcd endpoint is unhealthy; GENERATE_ALARM CRITICAL — Quorum lost (< 2/3 members healthy) |
CLEAR_ALARM when all members healthy AND quorum OK. |
Endpoint unhealthy or quorum lost. |
C00103 |
C00103_partition_certificate_monitor.pyh |
Yes (daily) | Yes | — | GENERATE_ALARM CRITICAL — Certificate expired or expires within ≤ 7 days; GENERATE_ALARM WARNING — Certificate expires within ≤ 90 days. Skipped if openssl is missing or certificate is unreadable. |
CLEAR_ALARM when no certificate is pending expiry. |
OpenSSL unavailable, certificate expired, or certificate expires within 7 days. |
C00104 |
C00104_partition_lacp_health_check.pyh |
Yes (hourly) | Yes | PLATFORM_REBOOT for the affected controller |
GENERATE_ALARM + GENERATE_EVENT CRITICAL — Any partition LACP member is unhealthy or not IN_SYNC |
CLEAR_ALARM when no LAGs exist in the partition, no members to check, or all partition members are healthy (unhealthy count = 0). |
Missing LAG/member, incorrect member count, or member not IN_SYNC. |
C00106 |
C00106_drbd_split_brain_health.pyh |
Yes (hourly) | Yes | — | GENERATE_ALARM + GENERATE_EVENT CRITICAL — DRBD split-brain (StandAlone) or dual-active (Primary/Primary) state; GENERATE_ALARM ERROR — Out-of-sync blocks detected (oos > 0) |
CLEAR_ALARM when DRBD is synced and single-active. |
Split-brain, dual-active, or out-of-sync blocks. |
C01001 |
C01001_blade_state.pyh |
Yes (hourly) | Yes | — | GENERATE_ALARM — Per blade: ping, SSH, or service failure; GENERATE_ALARM — Per blade: NFS inaccessible |
CLEAR_ALARM per blade when ping + SSH + service (+ NFS) all pass. |
Per-blade ping, SSH, or service failure. |
C01002 |
C01002_blade_pci_check.pyh |
Yes (hourly) | Yes | — | GENERATE_EVENT ERROR — Per blade: PCIe speed mismatch; GENERATE_EVENT ERROR — Per blade: PCIe width mismatch; GENERATE_EVENT + result error ERROR — Expected PCIe devices missing from the blade; GENERATE_ALARM ERROR — One or more devices fail speed/width check or are missing (alert=hardware-device-status) |
CLEAR_ALARM per blade when all expected PCIe devices match their configured speed and width. |
Skipped per blade if: not powered on, HAL unreachable, or FPGAs not loaded. ERROR if PCIe device list is empty. WARN if FPGAs not fully loaded (skips PCIe check for that blade). |
C01003 |
C01003_inter_fpga_link_scan.pyh |
No | No | — | None | None | WARN per link DOWN. ERROR if not all inter-FPGA ports could be evaluated. |
C01004 |
C01004_blade_drop_counters.pyh |
No | No | — | None | None | Any blade drop rate ≥ 100 drops/sec (1-minute average). |
C01005 |
C01005_blade_error_counters.pyh |
No | No | — | None | None | Any blade error rate ≥ 100 errors/sec (1-minute average). |
C01006 |
C01006_file_system_utilization.pyh |
No | No | — | None | None | Any filesystem path exceeds 90% disk space or inode usage. |
C01007 |
C01007_disk_io_utilization.pyh |
No | No | — | None | None | — |
C01008 |
C01008_cpu_utilization.pyh |
Yes (hourly) | Yes | — | GENERATE_ALARM + GENERATE_EVENT ERROR — Any qualifying CPU core sustains ≥ 95% active utilization over the 60-minute window. On blades, only cores with usedBy=F5OS or F5OS Dedicated are considered. |
CLEAR_ALARM when all qualifying cores are below 95% (60-minute average). Alert: resource-utilization. |
Any qualifying CPU core sustains ≥ 95% for 60 minutes, or any core/component exceeds 90% active. |
C01009 |
C01009_process_cpu_utilization.pyh |
No | No | — | None | None | — |
C01010 |
C01010_docker_cpu_utilization.pyh |
No | No | — | None | None | Any container normalized CPU exceeds 90% of node thread capacity. |
C01011 |
C01011_docker_memory_utilization.pyh |
No | No | — | None | None | tmstat_mem_stat_platform_total unavailable, or any container memory exceeds 90% of platform memory. |
C01012 |
C01012_process_memory_utilization.pyh |
No | No | — | None | None | — |
C01013 |
C01013_vqf_voq_health.pyh |
No | No | — | None | None | emmEnabled or immEnabled is not 1 for a VOQ whose destination is in the same partition. |
C01014 |
C01014_chassis_upgrade_state.pyh |
No | Yes | — | GENERATE_ALARM — Image install-status = failed or rollback stage = FAILED; GENERATE_EVENT — Same failed upgrade/rollback conditions |
CLEAR_ALARM when the install status is in the clear list (none, success, or aborted for install; idle or completed for rollback). |
Image install-status = failed or rollback stage = FAILED. |
C01016 |
C01016_platform_memory_utilization.pyh |
No | No | — | None | None | Platform memory usage reaches 90% in current or averaged windows. |
C01018 |
C01018_controller_switch_counters.pyh |
No | No | — | None | None | Controller switch drop/error rate reaches 100/sec over the 1-minute average. |
C01019 |
C01019_backplane_fabric_health.pyh |
Yes | Yes | PLATFORM_REBOOT for the affected blade |
GENERATE_ALARM — dot3 FCS/alignment rate ≥ 100 errors/sec over 1 minute; GENERATE_EVENT — Same sustained dot3 error-rate condition |
CLEAR_ALARM when the 1-minute average dot3 rate drops below 100/sec. Clears as soon as the rate drops, independently of any reboot recommendation. |
1. VOQ drop/error threshold and dot3 FCS threshold are both exceeded for a blade. 2. dot3 FCS/alignment rate ≥ 100/sec on a blade-associated port. |
C01020 |
C01020_partition_interface_state.pyh |
No | No | — | None | None | DOWN interfaces, state changes, invalid partition, or snapshot problems produce a WARNING result. |
C10003 |
C10003_memory_check.pyh |
No | No | — | None | None | Memory cannot be read or parsed, blade HAL is unreachable, or available memory falls below approximately 3 GB. |
| Script ID | Filename | Background Polling | Alarm Support | Action | Severity | Condition | Clear Condition |
|---|---|---|---|---|---|---|---|
S00002 |
S00002_platform_monitor_health.pyh |
No | No | — | — | — | — |
S00004 |
S00004_docker_restart_health.pyh |
No | No | — | — | — | — |
S00010 |
S00010_memory_health.pyh |
No | No | — | — | — | — |
S00011 |
S00011_dmesg_search.pyh |
No | No | — | — | — | — |
S00012 |
S00012_certificate_store_monitor.pyh |
Yes (daily) | Yes | GENERATE_ALARM |
CRITICAL | Certificate expired or expires within ≤ 7 days | CLEAR_ALARM when no certificate is pending expiry |
S00012 |
S00012_certificate_store_monitor.pyh |
Yes (daily) | Yes | GENERATE_ALARM |
WARNING | Certificate expires within ≤ 90 days | CLEAR_ALARM when no certificate is pending expiry |
S00013 |
S00013_lkrg_health.pyh |
No | No (events only) | GENERATE_EVENT |
— | A new, previously unseen LKRG log message is found, such as ALERT: BLOCK, ALERT: DETECT, DYING, ALIVE, or STATE |
— |
S00015 |
S00015_service_crash_loop.pyh |
No | No (events only) | GENERATE_EVENT |
— | A service restarts 3 or more times within 15 minutes | — |
S00016 |
S00016_filesystem_health.pyh |
Yes (hourly) | No (events only) | GENERATE_EVENT |
INFO | Disk-space or inode use exceeds 70% | — |
S00016 |
S00016_filesystem_health.pyh |
Yes (hourly) | No (events only) | GENERATE_EVENT |
WARNING | Disk-space or inode use exceeds 85% | — |
S00016 |
S00016_filesystem_health.pyh |
Yes (hourly) | No (events only) | GENERATE_EVENT |
CRITICAL | Disk-space or inode use exceeds 95% | — |
S00017 |
S00017_core_file_accumulation.pyh |
Yes (hourly) | No (events only) | GENERATE_EVENT |
WARNING | A new core file appears | — |
S00017 |
S00017_core_file_accumulation.pyh |
Yes (hourly) | No (events only) | GENERATE_EVENT |
CRITICAL | The same process creates 2 or more core files within 15 minutes | — |
S00019 |
S00019_oom_event_monitor.pyh |
No | No (events only) | GENERATE_EVENT |
— | New OOM-killed processes are found in kernel logs since the previous cached timestamp | — |
S00020 |
S00020_process_memory_leak.pyh |
No | No (events only) | GENERATE_EVENT |
— | At least 3 RSS samples show sustained growth: ≥ 50% growth, starting RSS ≥ 8 MiB, absolute growth ≥ 16 MiB, and projected OOM within 30 days | — |
S00021 |
S00021_system_health_summary.pyh |
No | No | — | — | — | — |
S00022 |
S00022_active_alarms.pyh |
No | No | — | — | Queries /system/alarms from ConfD and reports existing alarms in a table |
— |
| Constraint | Limit |
|---|---|
| Per-script timeout | 10 seconds (configurable). Scripts that query remote endpoints must set appropriate internal timeouts. |
| Total suite execution | All scripts running in parallel must complete within 15 seconds. |
| Memory | Scripts must not allocate more than 50 MB of memory. |
| Child processes | Scripts must not spawn more than five child processes. |