Bug ID 442869: GUI inaccessible on chassis when var/log/audit log is full

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
11.5.0, 11.5.1, 11.5.2, 11.5.3

Fixed In:
11.6.0, 11.5.4, 11.5.0 HF1

Opened: Jan 13, 2014

Severity: 3-Major

Symptoms

When MCP logging on a chassis is set to Enabled, Verbose, or Debug for Audit Logging, the system sends numerous messages to the var/log/audit log. This causes the log to fill, which might render the GUI inaccessible.

Impact

When the var/log/audit log is full, the GUI might become inaccessible.

Conditions

This occurs on chassis only when the Audit Logging option MCP is set to Enabled, Verbose, or Debug.

Workaround

The workaround is to specify Disabled for the MCP option in Audit Logging (available under the System :: Logs).

Fix Information

The primary blade formerly sent a message to all secondaries every second telling them to change the primary selection time. (The actual timestamp is correct and is the same every second.) Over time, this might fill up the audit log. This no longer occurs, and the message is now sent only when the primary actually changes.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips