Bug ID 1588093: Forwarding host log files to remote targets

Last Modified: Oct 21, 2024

Affected Product(s):
F5OS Velos(all modules)

Known Affected Versions:
F5OS-A 1.5.2, F5OS-A 1.7.0

Fixed In:
F5OS-A 1.8.0

Opened: May 22, 2024

Severity: 3-Major

Symptoms

/var/log/messages growing quickly, consuming the disk space, making the box unusable.

Impact

When syslog generated files are configured to be forwarded as files, forwarding efficiency can be affected compared to utilizing selectors. The /var/log/messages being in this list can lead to a cyclical logging issue, where the disk space is consumed faster than the logs can be rotated out, potentially resulting in a full disk.

Conditions

Having /var/log/messages as a host-logs files entry to forward the file lines to a remote destination.

Workaround

Use selectors instead for any file that is syslog generated. The host-logs files configuration is meant for text files that cannot be forwarded through selectors configuration.

Fix Information

To prevent filling the disk, files that are forwarded out line by line would not be processed locally. This will prevent having entries in /var/log/messages.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips