Last Modified: Sep 13, 2023
Affected Product(s):
BIG-IP LTM
Known Affected Versions:
11.6.1, 11.6.2, 12.0.0, 12.0.0 HF1, 12.1.0 HF1, 12.0.0 HF2, 12.1.0 HF2, 12.0.0 HF3, 12.0.0 HF4, 12.1.1 HF1, 12.1.1 HF2, 12.1.2 HF1, 12.1.2 HF2, 12.1.0, 12.1.1, 12.1.2, 12.1.3, 12.1.3.1, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1
Fixed In:
13.1.0, 12.1.3.2, 11.6.3
Opened: Dec 29, 2016 Severity: 3-Major
A monitor probe failure to a monitor (such as HTTP) is logged to '/var/log/ltm' when the probed resource is unavailable. In some cases, for a probe resulting in an 'Unable to connect' error, multiple log entries are made, with the last log entry being the error that triggered the log entry. The other monitor entries made during this event are not specifically relevant, as they are 'stale' and due to previous monitor probe behavior that was logged earlier. This is due to an error where the 'Could not connect' event appends rather than overwrites existing earlier error messages.
No system behavior is affected, but multiple log entries are made. The final log entry of the 'Could not connect' or 'Unable to connect' message is relevant, while the possible multiple log entries immediately preceding are 'stale' and not relevant (as they are due to an earlier issue that was previously successfully logged).
A monitor probe to a monitor is attempted (such as over HTTP), resulting in an 'Unable to connect' failure; and where that specific monitor previously reported an error (which is now appended).
For an external monitor that generates a 'Could not connect' or 'Unable to connect' error, consider only the last-line for the '/var/log/ltm' log entry, and ignore possibly-present log entries associated with that specific monitor that might be appear immediately above the 'Could not connect' line.
The system now handles previous monitor-log errors when reporting a 'Could not connect' error, rather than appending a previous error that might be present.