Last Modified: Sep 13, 2023
Affected Product(s):
BIG-IQ AppIQ
Fixed In:
8.0.0.1
Opened: Mar 07, 2021 Severity: 2-Critical Related Article:
K61201515
Attempting to aggregate statistics data from BIG-IQ can cause the Elasticsearch (ES) process in the data collection devices (DCDs) to restart every few hours. When this happens, the following exception appears in the elasticsearch/esnode.log file for affected DCDs: java.lang.NoClassDefFoundError: org/elasticsearch/client/RestClient
When BIG-IQ attempts to aggregate the statistics data under these conditions, the ES process fails and then restarts, resulting in the loss of that aggregated statistics data and pending module events.
Many statistic dimension combinations are defined for a specific module, which might create more unique ES documents than the allowed document limit per BIG-IP (50000 / DCDs num). For example, a managed BIG-IP device configured with an HTTP module might have traffic from multiple client IPs, with each client IP having multiple destination URLs.
Upgrade F5 Elasticsearch plugins.
This issue is fixed and the Elasticsearch process no longer restarts every few hours.