Last Modified: Oct 05, 2026
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 17.5.1.8, 17.5.1.9
Opened: Sep 17, 2026 Severity: 3-Major
On affected systems, the restjavad audit log (`/var/log/restjavad-audit.*.log`) does not contain entries for successful REST API calls (HTTP status < 400), such as PUT, POST, PATCH, or GET requests. Only requests that result in an error response (status = 400) are recorded. This occurs even when `audit.logging.FileHandler.level` is set to `INFO` (the default) or `FINE`
Loss of audit visibility for successful configuration changes and API activity performed through the REST API
This occurs on any BIG-IP system running an affected 17.5.x version. It reproduces when sending any successful REST API request to an endpoint that does not contain `/tokens/` in its URI, for example: curl -sk -u admin:admin -X PUT https://localhost/mgmt/tm/sys/dns -H 'Content-Type: application/json' -d '{"nameServers":["8.8.8.8","1.1.1.1"],"search":["example.com"]}' curl -sk -u admin:admin -X POST https://localhost/mgmt/tm/ltm/node -H 'Content-Type: application/json' -d '{"name":"node1","partition":"Common","address":"10.0.3.10"}' curl -sk -u admin:admin -X PATCH https://localhost/mgmt/tm/ltm/node/~Common~node1 -H 'Content-Type: application/json' -d '{"description":"web server 1 - dc1"}'
NA
None