Last Modified: Jul 12, 2023
Affected Product(s):
BIG-IP AFM, ASM, AVR
Known Affected Versions:
13.0.0
Fixed In:
13.1.0, 13.0.0 HF1
Opened: Mar 15, 2017 Severity: 3-Major
Some IP addresses may appear as "Aggregated" in the "COMMON" section of the dashboard but not Aggregated when applying a module-specific filter. This occurs because lack of memory space causes information to be aggregated in the "COMMON" section before being aggregated in the module-specific DB.
User sees a specific number (x) of IP addresses upon landing on the dashboard with "Aggregated" IP addresses, but when selecting a module-specific filter, statistics show a number plus another number (x+y) IP addresses (that is, essentially not aggregated).
A lot of diverse traffic (for some module) from many IP addresses (for example) on a system with a small amount of memory allocated for AVR.
Provision more memory to AVR.
With this fix, aggregation does not happen in COMMON before it happens in the specific module. This is correct behavior.