Bug ID 934801: Prevention of Audit data loss

Last Modified: Nov 07, 2022

Bug Tracker

Affected Product:  See more info
BIG-IP All(all modules)

Known Affected Versions:
16.0.0, 16.0.0.1, 16.0.1, 16.0.1.1, 16.0.1.2

Fixed In:
16.1.0

Opened: Aug 10, 2020
Severity: 4-Minor

Symptoms

Audit logs can consume all available partition space.

Impact

Audit data loss when /var/log is full.

Conditions

Audit logging enabled for a sufficient period of time

Workaround

You can recover disk space by manually removing unneeded logs in /var/log/audit.

Fix Information

The BIG-IP system periodically checks for free disk space at '/var/log'. If disk usage exceeds configured threshold and when software detects a possible problem with storing audit logs, all important processes are shut down to prevent generation of audit logs. If this occurs, the admin must manually recover the system.

Behavior Change