Non-functioning geo-ip database-f5-all

Non-functioning geo-ip database-f5-all
0

Non-functioning geo-ip database-f5-all

Vendor: f5

OS: all

Description:
indeni will alert if the geo-ip database is corrupted.

Remediation Steps:
Contact F5 support.

How does this work?
This alert logs into the F5 load balancer and makes a lookup in the geo-ip database to verify it’s functionality.

Why is this important?
The geo-ip database provides meta data related to an IP address, such as city, region, country and ISP. Should the database be unavailable any attempts to retrieve geo-ip data could cause unpredictable behaviour.

Without Indeni how would you find this?
To check the data base version, first log in to the unit with SSH. Then list the available files in “/shared/GeoIP”. For each file, issue the following command: "geoip_lookup -f /shared/GeoIP/ ". Example: “geoip_lookup -f /shared/GeoIP/F5GeoIP.dat 8.8.8.8”. If a record was returned the database is intact.

f5-geo-ip-lookup

name: f5-geo-ip-lookup
description: Determine last update of the geoip databases
type: monitoring
monitoring_interval: 60 minutes
requires:
    vendor: f5
    product: load-balancer
    linux-based: 'true'
    shell: bash
comments:
    geoip-database-version:
        why: |
            The geo-ip database provides meta data related to an IP address, such as city, region, country and ISP. Should this data be old or stale it could affect decisions taken based on geo-ip data in a negative way. For instance, a client might be refused access to critical services because his or her IP belongs to the wrong country.
        how: |
            This alert logs into the F5 load balancer and retrieves the current version of the geo-ip database.
        without-indeni: |
            To check the data base version, first log in to the unit with SSH. Then list the available files in "/shared/GeoIP". For each file, issue the following command: "geoip_lookup -f /shared/GeoIP/<filename> <IP>". Example: "geoip_lookup -f /shared/GeoIP/F5GeoIP.dat 8.8.8.8". Note the version informantion to determine the issue data of the database file. Example: "version = GEO-148 20170105" was issued 5th of January 2017.
        can-with-snmp: false
        can-with-syslog: false
        vendor-provided-management: Unknown
    geoip-database-state:
        why: |
            The geo-ip database provides meta data related to an IP address, such as city, region, country and ISP. Should the database be unavailable any attempts to retrieve geo-ip data could cause unpredictable behaviour.
        how: |
            This alert logs into the F5 load balancer and makes a lookup in the geo-ip database to verify it's functionality.
        without-indeni: |
            To check the data base version, first log in to the unit with SSH. Then list the available files in "/shared/GeoIP". For each file, issue the following command: "geoip_lookup -f /shared/GeoIP/<filename> <IP>". Example: "geoip_lookup -f /shared/GeoIP/F5GeoIP.dat 8.8.8.8". If a record was returned the database is intact.
        can-with-snmp: false
        can-with-syslog: false
        vendor-provided-management: Unknown
steps:
-   run:
        type: SSH
        command: 'for file in /shared/GeoIP/* ;do echo "---BEGINRECORD---";if [[ $file
            == *"v6"* ]] ; then ip="2001:4860:4860::8888"; else ip="8.8.8.8"; fi;echo
            "GeoIPDatabase: $file"; geoip_lookup -f $file $ip | egrep "(^country_name|^name
            =|version)"; echo "---ENDRECORD---"; done'
    parse:
        type: AWK
        file: geo-ip-lookup.parser.1.awk

f5_geoip_corrupt

// Deprecation warning : Scala template-based rules are deprecated. Please use YAML format rules instead.

package com.indeni.server.rules.library.templatebased.f5

import com.indeni.server.rules.RuleContext
import com.indeni.server.rules.library.templates.StateDownTemplateRule
/**
  *
  */
case class f5_geoip_corrupt() extends StateDownTemplateRule(
  ruleName = "f5_geoip_corrupt",
  ruleFriendlyName = "F5 Devices: Non-functioning geo-ip database",
  ruleDescription = "indeni will alert if the geo-ip database is corrupted.",
  metricName = "geoip-database-state",
  applicableMetricTag = "database",
  alertItemsHeader = "Affected Databased",
  alertDescription = "The geo-ip database provides meta data related to an IP address, such as city, region, country and ISP. Should the database be unavailable any attempts to retrieve geo-ip data could cause unpredictable behavior.\n\nThis alert was added per the request of <a target=\"_blank\" href=\"https://se.linkedin.com/in/patrik-jonsson-6527932\">Patrik Jonsson</a>.",
  baseRemediationText = "Contact F5 support.")()