f5 app report error iso partition,F5 v13.1 apm client iso

[PALEMARIE]

Dear all,

in F5 BigIP release 13 and above, a new ISO is mounted on the system.

This ISO not removable as it's system's ISO.

This causes a BAD result on device's health of F5 Analytics in splunk because of disk full.

I see in the app properties that the object is the following : 'Device Health' :

  <title>Overall Disk Space Health</title>
  <single>
    <search>
      <query>| `calc_host_disk_space_health(host_disk_space_health, perc_used, "*", "$host$", "`t_kpi_conf_interval`", "`t_kpi_disk_space_violation`", "`t_kpi_disk_space_overall`", "`t_kpi_violations_overall`", "`t_kpi_outliers`")` | `format_health(host_disk_space_health)`</query>
      <earliest>$Time.earliest$</earliest>
      <latest>$Time.latest$</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="numberPrecision">0.0</option>
    <option name="unit">%</option>
  </single>
</panel>
<panel>

Is there an option to ignore a partition in the health rating ?

best regards,
Pierre

[PALEMARIE]

Hello Dennis,

Thanks a lot, I'll test !

[dennis_morton]

Just edit the kpi_host_disk_space_health_search(2) macro and add a where condition that filters out that ISO mount. Something like this:

   | tstats max(all.perc_used) from datamodel="bigip-tmsh-disk_usage" where host="$host$" all.devicegroup="$devicegroup$" all.Filesystem!=<ISO Mount> by host all.devicegroup  _time span=`timechart_span` 
    | rename max(all.*) as * all.* as *