Bug ID 781581: Monpd uses excessive memory on requests for network_log data

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP AFM(all modules)

Known Affected Versions:
14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2

Fixed In:
15.1.0, 15.0.1.3, 14.1.2.3, 13.1.3.2

Opened: May 12, 2019

Severity: 3-Major

Symptoms

Monpd allocates excessive memory on multi-blade devices, and in some cases the kernel may kill monpd. The following log signature may be encountered in /var/log/kern.log: err kernel: : [1537424.588160] Out of memory: Kill process 28371 (monpd) score 117 or sacrifice child

Impact

Large fluctuations in host memory usage, occasionally leading to OOM events.

Conditions

This can occur in a multi-blade BIG-IP environment when you are displaying pages that query for network_log data, for example Bot Defense requests in the event log, or realtime AVR data.

Workaround

None.

Fix Information

A db variable has been added: avr.eventlogsreportrownumber, which controls the number of logs displayed. The db variable default is 10000, and supports a range from 100 through 1000000. Note: Using the maximum value may trigger the behavior described here. The system behavior depends on the specific machine hardware.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips