Applies To:

Show Versions Show Versions

sol14096: The BIG-IP system may unexpectedly reboot when the syslog-ng utility logs to a remote host
Known IssueKnown Issue

Original Publication Date: 01/07/2013
Updated Date: 04/25/2014

Description

The syslog-ng utility may cause high CPU utilization, resulting in a watchdog timeout and system reboot.

This issue occurs when the following conditions are met:

  • The syslog-ng utility is configured to log to a remote syslog server.
  • The BIG-IP system is unable to communicate with the remote syslog server.

If there is a disruption in the communication with the remote syslog server, the syslog-ng utility will not attempt to re-establish the connection until the syslog-ng service is restarted.

Impact

The system may crash and traffic through the BIG-IP system may be disrupted.

Symptoms

As a result of this issue, you may encounter the following symptoms:

  • The syslog-ng process shows CPU utilization greater than 90 percent using the following command:

    ps aux | grep syslog-ng

    For example:

    USER PID   %CPU %MEM  VSZ   RSS  TTY STAT  START  TIME COMMAND
    root 6394  0.93  0.0  3308  1508 ?   Ss    2012   0:02 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid

  • The system may experience a watchdog timeout and reboot.
  • After the system becomes unresponsive, it displays an error message in the /var/log/ltm file that appears similar to the following example:

    warning chmand[5255]: 012a0004:4: Host CPU subsystem reset caused by *** Super I/O watchdog timeout ***

Status

F5 Product Development has assigned ID 387640 to this issue, and has confirmed that this issue exists in the products listed in the Applies To box. For information about releases or hotfixes that resolve this issue, refer to the following table:

Type of Fix
Versions Fixed
Related Articles
Release 11.3.0
SOL2200: Most recent versions of F5 software
Hotfix 11.2.1 HF6
11.2.0 HF6
10.2.4 HF7
SOL9502: BIG-IP hotfix matrix

Workaround

You can mitigate this issue by ensuring that the remote syslog server is online and restarting the syslog-ng process, by entering the following command:

bigstart restart syslog-ng

Supplemental Information

Was this resource helpful in solving your issue?




NOTE: Please do not provide personal information.



Incorrect answer. Please try again: Please enter the words to the right: Please enter the numbers you hear:

Additional Comments (optional)