Bug ID 669046: Handling large replies to MCP audit_request messages

Last Modified: Oct 20, 2022

Bug Tracker

Affected Product:  See more info
BIG-IP TMOS(all modules)

Known Affected Versions:
16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.5, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 12.0.0, 11.6.5, 11.6.3, 11.6.2, 11.6.1

Fixed In:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5

Opened: Jun 13, 2017
Severity: 3-Major

Symptoms

When receiving very large replies to MCP messages (e.g., when viewing audit logs from the GUI), MCP can run out of memory and produce a core file. This is due in part to the amount of data returned, and also due in part to memory handling. In a production environment, fragmentation naturally occurs over the lifetime of MCP, thus increasing the odds of this happening. In addition, larger configurations cause more space to be consumed in MCPD and might more easily lead to the fragmentation, resulting in this issue.

Impact

Allocation of memory for viewing the audit logs fails. MCP can run out of memory and produce a core file.

Conditions

Receiving very large replies to MCP messages (e.g., from audit_request messages, which occurs when you view audit logs from the GUI). Memory usage is already high.

Workaround

Use tmsh/bash to view the audit logs instead of the GUI when audit logs are extremely large and memory usage is already high.

Fix Information

Viewing audit logs in the GUI is now limited to 10,000 lines, so this issue no longer occurs.

Behavior Change

The GUI is limited to viewing no more than 10,000 lines of the audit log. You can use tmsh/bash to view audit logs larger than 10,000 lines.