Last Modified: Nov 07, 2022
Affected Product(s):
BIG-IP ASM
Known Affected Versions:
12.1.0, 12.1.0 HF1, 12.1.0 HF2, 12.1.1, 12.1.1 HF1, 12.1.1 HF2, 12.1.2, 12.1.2 HF1, 12.1.2 HF2, 12.1.3, 12.1.3.1
Fixed In:
12.1.3.2
Opened: Sep 10, 2017 Severity: 3-Major
The GUI screen Security :: Event Logs : Application : Event Correlation reports the message: Event Correlation is not supported on this platform.
Under these conditions, Event Correlation is disabled.
Multi-bladed vCMP guest, running on a BIG-IP system with SSD drives, having only one available slot (other slots appear offline/unavailable).
The following workaround does not survive ASM restart. Thus, it has to be executed after every restart of ASM: ------------------------ # perl -MF5::ASMReady -MF5::Cfg -e 'while (! F5::ASMReady::is_asm_ready()) { print "Waiting for ASM to be ready.\n"; sleep 5; }; print "ASM is ready, patching Event Correlation cfg file\n"; F5::Cfg::cfg_set_config_item(qw{/etc/ts/correlation/correlation.cfg}, qw{General}, qw{Idle}, 0)' # pkill -f correlation ------------------------ Event Correlation should start with in ~15 seconds, after the execution of this workaround: ------------------------ # ps -elf | grep correlation 0 S root ... /usr/share/ts/bin/correlation ------------------------
Event Correlation is now enabled on a multi-bladed SSD vCMP guest with only one active slot.
