Bug ID 740589: MCPD crashes with core after 'tmsh edit /sys syslog all-properties'

Last Modified: Aug 18, 2023

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4, 13.1.1.5, 13.1.3, 13.1.3.1, 13.1.3.2, 13.1.3.3, 13.1.3.4, 14.0.0, 14.0.0.1, 14.0.0.2, 14.0.0.3, 14.0.0.4, 14.0.0.5, 14.0.1, 14.0.1.1, 14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 14.1.2.3, 14.1.2.4, 14.1.2.5, 14.1.2.6, 14.1.2.7, 14.1.2.8, 14.1.3, 15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.0.1.4, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 16.0.0, 16.0.0.1

Fixed In:
16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5

Opened: Aug 16, 2018

Severity: 3-Major

Symptoms

The syslog-ng consumes more than 95% of CPU starving other processes of CPU time. This leads to eventual Master Control Program Daemon (MCPD) crash with core.

Impact

Abnormal CPU usage. Potential eventual MCPD crash with core. Traffic disruption while MCPD restart.

Conditions

Configuring non-existent local IP addresses and remote log server.

Workaround

To mitigate the issue, you can use either of the following: -- Follow these two steps: 1. Remove the remote log server from the configuration. 2. Replace the non-existent local IP addresses with self-IP addresses. or -- Configure the remote destination host with a unique parameter in the configuration so that syslog works as expected when there are multiple entries: udp(192.0.2.1 port(512) localip(192.0.2.200) persist-name(r1)); udp(192.0.2.1 port(512) localip(192.0.2.201) persist-name(r2)); udp(192.0.2.100 port(512) localip(192.0.2.200) persist-name(r3)); udp(192.0.2.100 port(512) localip(192.0.2.201) persist-name(r4));

Fix Information

Fixed circular loop due to configuration with empty (duplicate) persist-name. The configuration will still fail to load if it is invalid, but it will fail early in the process before consuming excessive CPU.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips