For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MVA_60288's avatar
MVA_60288
Icon for Altocumulus rankAltocumulus
Jan 28, 2015

ASM out of memory XML/JSON processing

Hi, anyone else run into this error while continuing to up the XML memory allocation? We've gone to 500mb to 700mb (SOL10803) and still having this error re-occur. I have a case open with F5, but curious if anyone has run into this and what your (hopefully) final solution was.

 

Full error "ASM out of memory error: event code X239 Exceeded maximum memory assigned for XML/JSON processing"

 

ASM Advanced WAF
availability
security

16 Replies

Show More
  • Torti's avatar
    Torti
    Icon for Cirrus rankCirrus
    Jun 29, 2015

    The PID will change after a restart of the process - i.e. with restart of the the device.

     

    If you want to use a managemant tool with snmp, you have to poll 2 values

     

    1. the names with a walk through 1.3.6.1.2.1.25.4.2.1.2 and look for 'bd'

     

    2. the memory 1.3.6.1.2.1.25.5.1.1.2.x - x is the result of 1

     

  • prt1969_120570's avatar
    prt1969_120570
    Icon for Nimbostratus rankNimbostratus
    Dec 13, 2017

    Stupid question, but I am assuming that if you run into this problem, there may be tcp streams that do not get processed by ASM and are just sent thru without being inspected?

     

    • MVA's avatar
      MVA
      Icon for Nimbostratus rankNimbostratus
      Dec 13, 2017

      When this issue occurs traffic is blocked for that virtual server, I believe error is something like not enough memory to process XML request. It fails close.

       

  • gu3rr3ir0's avatar
    gu3rr3ir0
    Icon for Nimbostratus rankNimbostratus
    Oct 30, 2020

    Does anyone have a "final" solution for this. I have the exact same case, we up from 500 to 700 but still having issues with the out of memory logs still appearing.

     

    The trial and error of updating the Total XML Memory according to the "excedeed memory allocated" is not a good option, because it seems the more memory you configure the more memory XML resources will consume.

     

    At least the logs of exceeded memory allocated in bd.log should give us the correct value and not only 20, 30 or 40 Mb more than we have configured, and even if you configure more 200MB it still is giving the same messages.