Bug ID 745654: Heavy use of APM Kerberos SSO can sometimes lead to slowness of Virtual Server

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP APM(all modules)

Known Affected Versions:
12.1.0, 12.1.1, 12.1.2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.2, 13.1.1.3, 14.0.0, 14.0.0.1, 14.0.0.2, 14.0.0.3, 14.0.0.4, 14.1.0, 14.1.0.1

Fixed In:
15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4, 12.1.4.1

Opened: Oct 01, 2018

Severity: 3-Major

Symptoms

When there are a lot of tcp connections that needs new kerberos ticket to be fetched from kdc, then the websso processes requests slower than the incoming requests. This could lead to low throughput and virtual server is very slow to respond to requests.

Impact

Low throughput and slow responses from Virtual server.

Conditions

Large number of APM users using Kerberos SSO to access backend resources and all the tickets expire at the same time.

Workaround

There is no workaround at this time.

Fix Information

Increase the size of websso worker queue, so that tmm and websso process can communicate effectively. This eliminates VS slowness and hence increase throughput.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips