Bug ID 682612: Event Correlation is disabled on vCMP even though all the prerequisites are met.

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP ASM(all modules)

Known Affected Versions:
12.1.2, 12.1.3,

Fixed In:

Opened: Sep 10, 2017

Severity: 3-Major


The GUI screen Security :: Event Logs : Application : Event Correlation reports the message: Event Correlation is not supported on this platform.


Under these conditions, Event Correlation is disabled.


Multi-bladed vCMP guest, running on a BIG-IP system with SSD drives, having only one available slot (other slots appear offline/unavailable).


The following workaround does not survive ASM restart. Thus, it has to be executed after every restart of ASM: ------------------------ # perl -MF5::ASMReady -MF5::Cfg -e 'while (! F5::ASMReady::is_asm_ready()) { print "Waiting for ASM to be ready.\n"; sleep 5; }; print "ASM is ready, patching Event Correlation cfg file\n"; F5::Cfg::cfg_set_config_item(qw{/etc/ts/correlation/correlation.cfg}, qw{General}, qw{Idle}, 0)' # pkill -f correlation ------------------------ Event Correlation should start with in ~15 seconds, after the execution of this workaround: ------------------------ # ps -elf | grep correlation 0 S root ... /usr/share/ts/bin/correlation ------------------------

Fix Information

Event Correlation is now enabled on a multi-bladed SSD vCMP guest with only one active slot.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips