Can I get notified when a certificate is about to expire or a performance threshold is exceeded?

Short answer

Yes. The Certificate Expiry Notify Days field in a Load Balancer → Profiles → Notifications profile produces a notification when the specified number of days remains until the expiry of the certificate assigned to the vService and when it expires. In the same profile, the Bandwith, Request Rate, Current Session, Number of New Connections, 4xx responses/sec and 5xx responses/sec thresholds and the per-source-IP thresholds in the Per-source-IP Thresholds section are defined; the profile is assigned to an HTTP or L7 TCP vService with the Notification option. Device-wide CPU, memory, disk and bandwidth thresholds are defined on the Settings → General Settings → Notification Management screen by selecting the Notification Type. Notifications go through the channels turned on in the profile; as long as the alarm continues, they are repeated every day at 13:30.

Problem: Certificate Expiry and Load Increases Are Noticed Late

A certificate that expires causes the service to become unreachable suddenly, and an unnoticed load increase or rise in the error rate leads to an outage. These situations are required to be notified the moment the threshold is exceeded.

Solution: Three Methods

vService-specific certificate and traffic thresholds are defined with the Notifications profile, and the device's own resource thresholds with Notification Management; the two can be used together. WEB-CLI sets up the Notifications profile from the command line.

Your situation	Suitable method
vService certificate and traffic thresholds	Method 1: Notifications profile
Device-wide CPU, memory, disk, bandwidth	Method 2: Notification Management
Setting up vService thresholds from the command line	Method 3: WEB-CLI

Method 1: Notifications Profile Recommended

• How it works Certificates are checked every 3 hours and when the configuration changes. For traffic thresholds, if the value exceeds the limit for 8 seconds, a notification is produced; when the value returns to normal, this is also notified.
• Where it is openedLoad Balancer → Profiles → Notifications
• Requirement For e-mail, E-mail Settings (SMTP); for SNMP trap, SNMP settings
• vService type HTTP · L7 TCP
• Cluster Traffic threshold notifications are produced by the device whose Cluster ID is 1, while the connection between the devices continues.

Step-by-Step Configuration

1

Adım 1 Open the e-mail settings (if e-mail will be used)

On the Settings → General Settings → Notification Management screen, the E-mail Settings tab is selected and the Edit button is clicked (E-mail Settings editing form).

2

Adım 2 Enter the SMTP details

Host Device, Port, Authentication, Security and Sender Address are entered.

3

Adım 3 Test the settings

An address is written in the Test E-mail Address field next to the button and the Test E-mail Settings button is clicked; the arrival of the test e-mail is confirmed.

4

Adım 4 Save the e-mail settings

The Save E-mail Settings button is clicked.

5

Adım 5 Open the SNMP settings (if SNMP trap is to be used)

In the SNMP Settings tab of the same screen, the Edit button is clicked (SNMP Settings editing form).

6

Adım 6 Enter the SNMP target

SNMP Version (v1 or v2c), SNMP Community Name and SNMP IP:Port are entered. Traps are sent to this single target.

7

Adım 7 Save the SNMP settings

The Save SNMP Settings button is clicked.

8

Adım 8 Open the Notifications profile

On the Load Balancer → Profiles → Notifications screen, the Add button is clicked for a new profile, or the Edit button for an existing profile (profile add form). The new profile form opens with default values: Backend Service Status and vService Status on, Bandwith 128 Mbps, Request Rate 2500, Current Session 1000, Number of New Connections 1000, Certificate Expiry Notify Days 30; the 4xx/5xx thresholds and the per-source-IP thresholds off.

9

Adım 9 Enter the thresholds and channels

Notification Profile Name is entered. In the Certificate Expiry Notify Days field, how many days before the certificate expiry a notification is wanted is written (e.g. 30); if the field is left empty or 0, the certificate is not checked. The switch of each wanted threshold is turned on and a value is entered (e.g. Request Rate 5000, 5xx responses/sec 50); a threshold whose switch is off is not monitored. The per-source-IP thresholds are in the Per-source-IP Thresholds section. The channels are turned on: for E-mail and SMS, the recipients are written in the profile; SNMP trap and UI notification are turned on with a switch. If no channel is turned on, the notification is written only to Notification Logs.

10

Adım 10 Save the profile

The Add button is clicked for a new profile, or the Edit button for an existing profile. If the profile is already assigned to a vService, the change takes effect immediately and the next steps are skipped.

11

Adım 11 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected.

12

Adım 12 Assign the profile to the vService

In the Details panel on the right of the form, Notification is checked and the created profile is selected from the profile list (how to add to a vService). In the Default Profile that comes when it is checked, no channel is on; this profile writes notifications only to Notification Logs.

13

Adım 13 Save

The Save button is clicked. The progress of applying the change is followed from the sync indicator at the bottom right of the screen. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent manually with Synchronize.

Verification

1TestTR7 side

The Request rate threshold is temporarily lowered to a low value, and traffic is sent to the vService for longer than 8 seconds.

ExpectedHTTP request rate is high for vService "…": > …

2Notification LogsTR7 side

On the Settings → System Logs → Notification Logs screen, the vService statistics and Certificate status records are checked (notification types).

ExpectedNotification record and channel result

Method 2: Notification Management (Device-Wide)

• How it works Device-wide thresholds are notified to the people in the selected Contact groups through the selected channel.
• Where it is openedSettings → General Settings → Notification Management → Notifications
• Requirement For e-mail, E-mail Settings (SMTP); for recipients, Contact Groups
• Scope The whole device; not assigned to a vService
• Ready-made records The device comes with the CPU Notification, Memory Notification and Disk Notification records ready, with a 90% limit, the Send e-mail and Notify UI channels and the Admins group; the record is edited only if the limit is to be changed.

Step-by-Step Configuration

1

Adım 1 Open the e-mail settings (if e-mail will be used)

On the Settings → General Settings → Notification Management screen, the E-mail Settings tab is selected and the Edit button is clicked.

2

Adım 2 Enter the SMTP details

Host Device, Port, Authentication, Security and Sender Address are entered.

3

Adım 3 Test the settings

An address is written in the Test E-mail Address field and the Test E-mail Settings button is clicked.

4

Adım 4 Save the e-mail settings

The Save E-mail Settings button is clicked.

5

Adım 5 Open the contact group form (if needed)

In the Contact Groups tab of the same screen, the Add button is clicked (Contact Groups add form). The ready-made Admins group covers the users of the Super Admin type; if it is sufficient, this step and the next two steps are skipped.

6

Adım 6 Select the recipients

The group name is entered and the recipients are selected.

7

Adım 7 Save the group

The Add button at the bottom of the form is clicked.

8

Adım 8 Open the notification form

In the Notifications tab, the Add button is clicked for a new notification, or the Edit button for a ready-made record.

9

Adım 9 Select the type, limit and recipients

The Notification Type (e.g. CPU usage, Memory usage, Disk, Bandwidth) is selected and the limit is entered (limits); Notification Action (Send e-mail, Send sms, SNMP trap, Notify UI) and Notification Contacts are selected.

10

Adım 10 Save

The Add button is clicked for a new record, or the Edit button for an existing record.

Verification

1Notification LogsTR7 side

On the Settings → System Logs → Notification Logs screen, records such as CPU usage and Memory usage are checked (notification types).

ExpectedNotification record and channel result

Method 3: WEB-CLI

• How it works A Notifications profile with thresholds is created from the command line and assigned to the vService.
• Where it is opened TR7 WEB-CLI → lb notification · lb service (threshold measures)
• Requirement WEB-CLI access; for e-mail, E-mail Settings (SMTP)
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Create the profile

On the command line, only the written fields are turned on; the default values in the interface do not come, and Backend Service Status (--serviceStatus) and vService Status (--poolStatus) also start off. The command below creates a profile that turns on e-mail notification for the request rate, the 5xx rate and the certificate expiry:

lb notification add name trafik-esikleri --reqRate 5000 --resp5xx 50 --notifyDaysBeforeCertificateExpiry 30 --email.0 noc@example.com

2

Adım 2 Assign the profile to the vService

lb service update id <vService> --notification trafik-esikleri

--notification is the main notification profile of the vService; if the vService already has a profile, the command replaces it. The current assignment is first viewed with lb service show <vService>.

Verification

1Profile recordWEB-CLI

Command: lb notification show trafik-esikleri

ExpectedreqRate 5000 · resp5xx 50 · notifyDaysBeforeCertificateExpiry 30

2Notification LogsTR7 side

On the Settings → System Logs → Notification Logs screen, the record is checked.

ExpectedNotification record and channel result

Common Mistakes

• Leaving the certificate field empty or 0. In this case, the certificate is not checked.
• Expecting the certificate notification to arrive immediately. The check runs every 3 hours and when the configuration changes.
• Expecting the IP address in a source IP threshold notification. The notification text does not contain the address; the busiest clients are seen on the Live Stats screen and in Logs & Tracking.
• Assuming that the Bandwith threshold is only incoming traffic. The value is the total of incoming and outgoing traffic.
• Expecting notifications with the Default profile. No channel is on in the Default profile; the record goes only to Notification Logs.
• Looking for Notification on a Network vService. The Notification option exists only on HTTP and L7 TCP vServices.

How it is done in the documentation

• Notifications · Certificate Expiry Notify Days
• Notifications · General Thresholds and Channels
• Notifications · Per-Source-IP Thresholds
• Notification Management · Limit (CPU / Memory / Disk / Bandwidth)

Related questions

• Can I get notified when a vService goes down; which channels are available (SNMP, e-mail, SMS)?
• Can I define advanced notifications based on source IP, country, ASN or subnet (Advanced Notifications)?
• What kind of statistics can I collect with Advanced Traffic Inspection?