Forum Discussion

Sebastian_Maniak's avatar
Nov 07, 2015

DDoS Profile causes reboot of system

Hi,

 

I was wondering if anyone has come across this, i setup a ddos profile on my VM v12.0 for some testing.

 

When i enable it on a couple VS, the F5 goes crazy and starts rebooting all services. Has anyone come across this issues?

 

here are the logs.

 

Sat Nov 7 03:26:07 EST 2015noticebigip03syslog-ng[2382]Configuration reload request received, reloading configuration; Sat Nov 7 03:43:28 EST 2015noticebigip03loggerStarted writing core file: /var/core/tmm.0.bld0.0.606.core.gz for PID 31716 Sat Nov 7 03:44:01 EST 2015noticebigip03loggerFinished writing 195479426 bytes for core file: /var/core/tmm.0.bld0.0.606.core.gz for PID 31716 Sat Nov 7 03:44:55 EST 2015noticebigip03setseboolThe allow_dynad policy boolean was changed to on by root Sat Nov 7 04:18:57 EST 2015noticebigip03loggerStarted writing core file: /var/core/tmm.0.bld0.0.606.core.gz for PID 4585 Sat Nov 7 04:19:28 EST 2015noticebigip03loggerFinished writing 196700397 bytes for core file: /var/core/tmm.0.bld0.0.606.core.gz for PID 4585 Sat Nov 7 04:20:24 EST 2015noticebigip03setseboolThe allow_dynad policy boolean was changed to on by root Sat Nov 7 04:54:25 EST 2015noticebigip03loggerStarted writing core file: /var/core/tmm.0.bld0.0.606.core.gz for PID 10000 Sat Nov 7 04:54:56 EST 2015noticebigip03loggerFinished writing 195974327 bytes for core file: /var/core/tmm.0.bld0.0.606.core.gz for PID 10000 Sat Nov 7 04:56:07 EST 2015noticebigip03setseboolThe allow_dynad policy boolean was changed to on by root

 

3 Replies

  • It seems your BIG-IP coredumps when you enable that profile - all those messages about "Finished writing ... for core file: /var/core/..." That means you have core files in your /var/core directory. Raise a support case with F5 and they will halp you analyze the core files and find the cause for it.

     

  • Did you ever figure this out? I have an active/standby pair that keep core dumping since upgrading to version 12. Just happened while I was logged in and I see this message right after the core dump. I have a case open with F5 and they are still investigating.
  • Nath's avatar
    Nath
    Icon for Cirrostratus rankCirrostratus
    We have v12 A-S mode so far no problem with the ASM