Bug ID 511985: Large numbers of ERR_UNKNOWN appearing in the logs

Last Modified: Oct 17, 2023

Affected Product(s):
BIG-IP All(all modules)

Known Affected Versions:
11.4.1, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.6.0, 11.6.1, 12.1.0 HF1, 12.1.0 HF2, 12.1.1 HF1, 12.1.1 HF2, 12.1.2 HF1, 12.1.2 HF2

Fixed In:
12.0.0, 11.6.2, 11.5.6

Opened: Mar 12, 2015

Severity: 2-Critical

Related Article: K46811087

Symptoms

There are times when LTM Policy subsystem attempts to execute particular actions, which fail and result in LTM Policy writing an error to the logs with an error type of ERR_UNKNOWN.

Impact

This is a case of unnecessary logging, and there is no adverse effect other than a higher-than-normal amount of logging.

Conditions

While not limited only to the ASM module, this has been observed when ASM is active and experiencing high traffic volumes. The logging of ERR_UNKNOWN occurs when filters and plug-ins experience failures (such as out of memory) and react by initiating a reset of the connection. When these filters and plug-ins return an error to LTM Policy, LTM Policy logs ERR_UNKNOWN, as it should.

Workaround

None.

Fix Information

Before logging ERR_UNKNOWN, LTM Policy now checks to see whether a filter or plug-in has marked the connection to be reset. If the connection is about to be reset, then ERR_UNKNOWN is not logged.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips