Last Modified: May 29, 2024
Affected Product(s):
BIG-IP LTM
Known Affected Versions:
13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4, 13.1.1.5, 13.1.3, 13.1.3.1, 13.1.3.2, 13.1.3.3, 13.1.3.4, 14.0.0, 14.0.0.1, 14.0.0.2, 14.0.0.3, 14.0.0.4, 14.0.0.5, 14.0.1, 14.0.1.1, 14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 14.1.2.3, 14.1.2.4, 14.1.2.5, 14.1.2.6, 14.1.2.7, 14.1.2.8, 14.1.3, 15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.0.1.4, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 16.0.0, 16.0.0.1
Fixed In:
16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5
Opened: Aug 16, 2018 Severity: 3-Major
The syslog-ng consumes more than 95% of CPU starving other processes of CPU time. This leads to eventual Master Control Program Daemon (MCPD) crash with core.
Abnormal CPU usage. Potential eventual MCPD crash with core. Traffic disruption while MCPD restart.
Configuring non-existent local IP addresses and remote log server.
To mitigate the issue, you can use either of the following: -- Follow these two steps: 1. Remove the remote log server from the configuration. 2. Replace the non-existent local IP addresses with self-IP addresses. or -- Configure the remote destination host with a unique parameter in the configuration so that syslog works as expected when there are multiple entries: udp(192.0.2.1 port(512) localip(192.0.2.200) persist-name(r1)); udp(192.0.2.1 port(512) localip(192.0.2.201) persist-name(r2)); udp(192.0.2.100 port(512) localip(192.0.2.200) persist-name(r3)); udp(192.0.2.100 port(512) localip(192.0.2.201) persist-name(r4));
Fixed circular loop due to configuration with empty (duplicate) persist-name. The configuration will still fail to load if it is invalid, but it will fail early in the process before consuming excessive CPU.