Bug ID 493524: ASM attack appear ongoing forever if restarting dosl7d during an attack

Last Modified: Oct 17, 2023

Affected Product(s):
BIG-IP TMOS(all modules)

Known Affected Versions:
12.1.3, 12.1.2, 12.1.1, 12.1.0, 12.0.0

Opened: Nov 30, 2014

Severity: 3-Major

Symptoms

If dosl7d is restarted during an attack it doesn't write the "end attack" event to logdb.

Impact

Attack appears ongoing in Dos Overview page (even though it should be marked "ended").

Conditions

Restarting dosl7d in the middle of an ASM attack (including actions that implicitly cause dosl7d restart like tmm restart or reboot).

Workaround

No workaround.

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips