Bug ID 423928: syslog messages over 8 KB in length cause logstatd to exit

Last Modified: Jul 13, 2024

Affected Product(s):
BIG-IP APM(all modules)

Known Affected Versions:
11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.1 HF1, 11.5.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.1 HF10, 11.5.1 HF11, 11.5.2, 11.5.2 HF1, 11.5.3, 11.5.3 HF1, 11.5.3 HF2, 11.5.4, 11.5.4 HF1, 11.5.4 HF2, 11.5.4 HF3, 11.5.4 HF4, 11.5.5, 11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4, 11.6.0 HF5, 11.6.0 HF6, 11.6.0 HF7, 11.6.0 HF8, 11.6.1, 11.6.1 HF1, 11.6.1 HF2, 11.6.2, 11.6.2 HF1

Fixed In:
12.0.0, 11.6.3, 11.5.6

Opened: Jun 25, 2013

Severity: 3-Major

Related Article: K42630383

Symptoms

Creating a syslog longer than 8 KB in length might cause logstatd to issue an exception and exit.

Impact

logstatd exits and posts a message similar to the following: localhost emerg logger: Re-starting logstatd.

Conditions

This occurs when the system processes a syslog message that is longer than 8 KB.

Workaround

Configure syslog smaller than (or equal to) 8 KB using a command similar to the following in bigip_base.conf: sys syslog { include "options { ... log_msg_size(8192); };" }.

Fix Information

syslog messages over 8 KB can now be processed, and the system does not exit. Note that the system does not process any log entry that is three times the buffer length or greater than 12 KB.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips