Bug ID 747225: PCCD may get into crash-loop after BIG-IP upgrade or after BIG-IP restart

Last Modified: May 23, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP AFM(all modules)

Known Affected Versions:
13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4, 13.1.1.5

Fixed In:
15.0.0

Opened: Oct 18, 2018
Severity: 2-Critical

Symptoms

When there are scheduled firewall rules, and per-policy compilation optimization enabled, PCCD may enter crash-loop after installing new build. In very rare cases this can happen after regular BIG-IP restart. Per-policy compilation optimization is enabled by default, the sys db variable pccd.perpolicycompilation is true.

Impact

After this failure, an rare problem is that PCCD is continuously crashing. New firewall config is not applied on data traffic. The pre-upgrade firewall config is still applied on data traffic.

Conditions

-- AFM is licensed and provisioned. -- There are scheduled firewall rules. -- Per-policy compilation optimization enabled (sys db variable pccd.perpolicycompilation is true) -- The BIG-IP system is upgraded or restarted

Workaround

Set sys db variable pccd.perpolicycompilation to false.

Fix Information

PCCD works correctly in these conditions.

Behavior Change