Last Modified: Sep 10, 2026
Affected Product(s):
BIG-IQ Platform
Known Affected Versions:
8.4.0, 8.4.1, 8.4.2, 8.4.2.1, 8.4.2.2
Opened: Mar 26, 2024 Severity: 3-Major
An error similar to the following appears in /var/log/tokumon/current: 2024-03-10_16:23:56.65227 [SEVERE] es: _index:dns command:index status:400 _id:https://localhost/mgmt/cm/dns/working-config/wideip/a/5c920961-639d-3fb0-b067-6b0e60ffb3c8 error:{"type":"illegal_argument_exception","reason":"Limit of total fields [5000] in index [dns] has been exceeded"} see searchd log for complete error.
The DNS records are not listed during Global Search or DNS configurations may not be imported properly
Using the global search, the DNS records are not listed. or During an import the conflict resolution page will not display when there are more than 5000 DNS Config Documents
For estimating the total_fields limit value, use the following command: curl -s XGET "localhost:9210/dns/_mapping" | jq . | grep "\":" | wc -l You can work around this issue using the following steps: 1. Change /usr to read/write: mount -o remount,rw /usr 2. Change to the directory: cd /usr/share/rest/tokumon/config/modules 3. Make a copy of dns.js: cp dns.js dns.js.orig 4. Edit dns.js using nano,vi, etc 5. Under "settings"."index", change the following line : settings: {}, // Use these to overwrite parts or all of ES_SETTINGS to this: settings: { // Use these to overwrite parts or all of ES_SETTINGS "index" : { "mapping" : { "total_fields" : { "limit" : "5000" } } } }, 6. Save and quit 7. Force tokumon to delete and rebuild all indices: bigstart kill tokumond NOTE: If tokumon begins restarting constantly, there is a likely syntax error in the changes made in step 5. Stop tokumond (bigstart stop tokumond) and repeat step 5 to find the error. If you continue to have similar error for new limit repeat Step 4-7 with limit increased by 5000(Max limit value can be set to 20000). If the problem persists, revert the file to the copy made in step 3 and open a case. 8. If tokumon is not restarting, wait about 5 minutes for the indices to be created and verify the change: curl -s localhost:9210/dns/_settings | jq .dns.settings.index.mapping Output: { "total_fields": { "limit": "10000" } } 9. Ensure /usr is set to readonly: mount -o remount,ro /usr
None