Last Modified: Oct 20, 2022
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.5, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 12.0.0, 11.6.5, 11.6.3, 11.6.2, 11.6.1
Fixed In:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
Opened: Jun 13, 2017 Severity: 3-Major
When receiving very large replies to MCP messages (e.g., when viewing audit logs from the GUI), MCP can run out of memory and produce a core file. This is due in part to the amount of data returned, and also due in part to memory handling. In a production environment, fragmentation naturally occurs over the lifetime of MCP, thus increasing the odds of this happening. In addition, larger configurations cause more space to be consumed in MCPD and might more easily lead to the fragmentation, resulting in this issue.
Allocation of memory for viewing the audit logs fails. MCP can run out of memory and produce a core file.
Receiving very large replies to MCP messages (e.g., from audit_request messages, which occurs when you view audit logs from the GUI). Memory usage is already high.
Use tmsh/bash to view the audit logs instead of the GUI when audit logs are extremely large and memory usage is already high.
Viewing audit logs in the GUI is now limited to 10,000 lines, so this issue no longer occurs.
The GUI is limited to viewing no more than 10,000 lines of the audit log. You can use tmsh/bash to view audit logs larger than 10,000 lines.