Bug ID 699655: apmd may spend a lot of time initializing AD Query agent that can cause apmd to restart

Last Modified: Sep 06, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP APM(all modules)

Known Affected Versions:
11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4, 11.6.0 HF5, 11.6.0 HF6, 11.6.0 HF7, 11.6.0 HF8, 11.6.1, 11.6.1 HF1, 11.6.1 HF2, 11.6.2, 11.6.2 HF1, 11.6.3, 11.6.3.1, 11.6.3.2, 11.6.3.3, 11.6.3.4, 11.6.4, 11.6.5, 12.1.0, 12.1.0 HF1, 12.1.0 HF2, 12.1.1, 12.1.1 HF1, 12.1.1 HF2, 12.1.2, 12.1.2 HF1, 12.1.2 HF2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 12.1.4.1, 12.1.5, 14.0.0, 14.0.0.1, 14.0.0.2, 14.0.0.3, 14.0.0.4, 14.0.0.5, 14.0.1, 14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.4, 14.1.0.5, 14.1.0.6, 14.1.2

Opened: Dec 21, 2017
Severity: 3-Major

Symptoms

apmd restart. in some rare cases apmd cannot start up restarting in a loop

Impact

users are not able to log in

Conditions

- AD domain contains thousands of groups, so it takes more than 30 seconds to build local group cache for AD Query agent. - BIG-IP is configured with more than one Access Policy, each of them has at least one AD Query agent, every AD Query agent uses the one shared AAA AD Server. - multiple requests sent at the same time, during initialization of apmd more chances to observe the issue when changes to AAA AD Server have being made during group cache update process (that takes a while)

Workaround

temporarily stop load on the BIG-IP, wait until apmd starts up, run one session, wait until group cache is updated, resume service requests

Fix Information

None

Behavior Change