Dear all,
in F5 BigIP release 13 and above, a new ISO is mounted on the system.
This ISO not removable as it's system's ISO.
This causes a BAD result on device's health of F5 Analytics in splunk because of disk full.
I see in the app properties that the object is the following : 'Device Health' :
<title>Overall Disk Space Health</title>
<single>
<search>
<query>| `calc_host_disk_space_health(host_disk_space_health, perc_used, "*", "$host$", "`t_kpi_conf_interval`", "`t_kpi_disk_space_violation`", "`t_kpi_disk_space_overall`", "`t_kpi_violations_overall`", "`t_kpi_outliers`")` | `format_health(host_disk_space_health)`</query>
<earliest>$Time.earliest$</earliest>
<latest>$Time.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="numberPrecision">0.0</option>
<option name="unit">%</option>
</single>
</panel>
<panel>
Is there an option to ignore a partition in the health rating ?
best regards,
Pierre
Hello Dennis,
Thanks a lot, I'll test !
Just edit the kpi_host_disk_space_health_search(2) macro and add a where condition that filters out that ISO mount. Something like this:
| tstats max(all.perc_used) from datamodel="bigip-tmsh-disk_usage" where host="$host$" all.devicegroup="$devicegroup$" all.Filesystem!=<ISO Mount> by host all.devicegroup _time span=`timechart_span`
| rename max(all.*) as * all.* as *