Symptoms

Secure Web Gateway (SWG) URL categorization may cause the /var file system to fill. This might manifest in the following ways. 1. The /var/lib/mysql file system is full or approaching 100% utilization, as shown in the following example: # df -h /var/lib/mysql Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg--db--vda-app.ASWADB.set.1.mysqldb 12G 11G 576M 95% /var/lib/mysql 2. The database and index files for SWG URL categorization have grown very large, as shown in the following example: -- /var/lib/mysql/AVR/AVR_DIM_APM_SWG_URL.MYD: 8.1G <--- Database! -- /var/lib/mysql/AVR/AVR_DIM_APM_SWG_URL.MYI: 765M <--- Index!

Impact

This results in the following impacts: - SWG-related operations dependent on MySQL may fail. - Once the /var/lib/mysql file system reaches 100% utilization, other BIG-IP system functions that are dependent on the MySQL system may also experience issues.

Conditions

SWG is provisioned and configured to perform URL classification, and a large amount of web traffic is being proxied by the SWG system.

Workaround

The issue can be worked around by resetting the AVR statistics. You can find information on how to reset AVR statistics in SOL14956: Resetting BIG-IP AVR statistics, available at https://support.f5.com/kb/en-us/solutions/public/14000/900/sol14956.html. Impact of procedure: The procedure removes all Analytics data and resets the MySQL database.

Fix Information

Secure Web Gateway (SWG) URL categorization no longer causes the /var file system to fill.

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips