Last Modified: Jul 24, 2024
Affected Product(s):
BIG-IP AAM, AFM, APM, ASM, AVR, CGN, DDHD, DNS, GTM, LTM, PEM, PSM, SSLO, SWG, TMOS, vCMP, WAM, WOM
Known Affected Versions:
14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 14.1.2.3, 14.1.2.4, 14.1.2.5, 14.1.2.6, 14.1.2.7, 14.1.2.8, 14.1.3, 14.1.3.1, 14.1.4, 14.1.4.1, 14.1.4.2, 14.1.4.3, 14.1.4.4, 14.1.4.5, 14.1.4.6, 14.1.5, 14.1.5.1, 14.1.5.2, 14.1.5.3, 14.1.5.4, 14.1.5.6, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1, 15.1.10, 15.1.10.2, 15.1.10.3, 15.1.10.4, 16.1.0, 16.1.1, 16.1.2, 16.1.2.1, 16.1.2.2, 16.1.3, 16.1.3.1, 16.1.3.2, 16.1.3.3, 16.1.3.4, 16.1.3.5, 16.1.4, 16.1.4.1, 16.1.4.2, 16.1.4.3, 16.1.5, 17.0.0, 17.0.0.1, 17.0.0.2, 17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3
Opened: Mar 15, 2024 Severity: 3-Major
When generating a qkview on a BIG-IP system via the GUI or command line: -- Log files included in the qkview will be truncated if they exceed the maximum log file size. -- Log file truncation occurs even with the "-s 0" command line option or "Unlimited snaplen" GUI checkbox, if the log file exceeds 100MB in size. -- No user-visible notification is provided that log file truncation has occurred. The "Unlimited snaplen" GUI checkbox does not actually remove the maximum log file size limit of 100MB. Selecting the "Unlimited snaplen" GUI checkbox limits the maximum log file size to 100MB. Log files larger than 100MB will still be truncated, even if the "Unlimited snaplen" checkbox is selected when generating a Support Snapshot from the GUI.
Log files included in qkviews may be truncated unexpectedly without the user being aware. If additional actions are not taken to create untruncated archives of affected log files, data required to diagnose BIG-IP issues may be permanently lost due to incomplete data in the qkview, and subsequent log rotation on the affected BIG-IP system.
Log file truncation occurs if: -- The log file exceeds 5MB in size and: -- The qkview utility is launched from the command line without the "-s" option to specify a larger maximum file size, or a Support Snapshot is request from the GUI without selecting the "Unlimited snaplen" checkbox. -- The log file exceeds 100MB in size and: -- The qkview utility is launched from the command line with the "-s 0" option to specify a 100MB maximum file size, or a Support Snapshot is request from the GUI without selecting the "Unlimited snaplen" checkbox. -- The log file exceeds the maximum file size specified by the "-s" option when running the qkview utility from the command line.
To check whether a qkview file contains truncated log files, use the "tar" utility at a command line to check for files with "_truncated" appended to the file name. For example: tar -tf /var/tmp/my-test-qkview.qkview | grep truncated var/log/DBDaemon-0.log_truncated If the qkview file contains truncated log files, manually create a log file archive containing untruncated versions of the affected log files.
None