Bug ID 812373: Data Collection Device inoperative after a service is forced to restart

Last Modified: Jul 12, 2023

Affected Product(s):
BIG-IQ System User Interface(all modules)

Known Affected Versions:
6.1.0, 7.0.0, 7.0.0.1, 7.0.0.2, 7.1.0, 7.1.0.1, 7.1.0.2, 7.1.0.3, 7.1.6, 7.1.6.1, 7.1.7, 7.1.7.1, 7.1.7.2, 7.1.8, 7.1.8.1, 7.1.8.2, 7.1.8.3, 7.1.8.4, 7.1.8.5, 7.1.9, 7.1.9.7, 7.1.9.8, 7.1.9.9

Opened: Aug 05, 2019

Severity: 3-Major

Symptoms

Data Collection Device (DCD) cluster fails to collect data or respond to queries causing issues with event collection and visualization.

Impact

DCD and visualization becomes inoperative.

Conditions

If one or more of the DCDs becomes unreachable from the BIG-IQ or other DCDs due to networking, restarting, or other environmental issues, it is possible that the DCD cluster can become unhealthy and unable to respond to inbound data or query requests. Issues like excessive memory usage or network instability can trigger these erratic changes.

Workaround

If data backups (snapshots) or data loss is acceptable then: -- Stop elasticsearch process on BIG-IQ and each DCD by typing the command: bigstart stop elasticsearch -- Delete the contents of /var/config/rest/elasticsearch/data directory on the devices by typing: rm -rf /var/config/rest/elasticsearch/data/* -- Restart elasticsearch process on BIG-IQ and each DCD by typing: bigstart start elasticsearch

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips