Bug ID 934801: Prevention of Audit data loss

Last Modified: Jul 12, 2023

Affected Product(s):
BIG-IP All(all modules)

Known Affected Versions:
16.0.0, 16.0.0.1, 16.0.1, 16.0.1.1, 16.0.1.2

Fixed In:
16.1.0

Opened: Aug 10, 2020

Severity: 4-Minor

Symptoms

Audit logs can consume all available partition space.

Impact

Audit data loss when /var/log is full.

Conditions

Audit logging enabled for a sufficient period of time

Workaround

You can recover disk space by manually removing unneeded logs in /var/log/audit.

Fix Information

The BIG-IP system periodically checks for free disk space at '/var/log'. If disk usage exceeds configured threshold and when software detects a possible problem with storing audit logs, all important processes are shut down to prevent generation of audit logs. If this occurs, the admin must manually recover the system.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips