For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cd's avatar
cd
Icon for Cirrus rankCirrus
Jan 15, 2018

F5 /shared volume getting full

Hello,

 

One of our F5 /shared volume is getting abnormally full. In the top 10 files, we get a few files like this:

 

1068288000 /shared/tmp/im8067/configsync-2.0-1-Linux-2.6.32431.56.1.6.5.8664.im

 

1067069440 /shared/tmp/im29232/configsync-2.0-1-Linux-2.6.32431.56.1.6.5.8664.im

 

Do you have any idea what are those configsync files ? Is this linked to configsync F5 feature ?

 

Regards,

 

BIG-IP
LTM
security

2 Replies

  • cd's avatar
    cd
    Icon for Cirrus rankCirrus
    Jan 17, 2018

    For your information, I found the root cause. Our remote backup script would timeout before the save sys ucs command would finish, resulting in temp files in /shared/tmp.

     

    I manually cleaned those, and fixed our script, and everything went back to normal.

     

  • JoshBecigneul's avatar
    JoshBecigneul
    Icon for MVP rankMVP
    Jan 17, 2018

    Hello SRT Admin,

    One way we deal with this is to trigger the backup worker over the REST API, which is located at the 

    /mgmt/tm/shared/sys/backup
    endpoint.

    If you POST to 

    /mgmt/tm/shared/sys/backup
    with a JSON payload of 
    {'file':,'action':'BACKUP'}
    , replacing
    with the name of your archive file, you should see a HTTP 202 response if the job was created successfully which will include some details about the job.

    You can run a GET query for a running task using the 

    id
    that was returned at the same endpoint: 
    /mgmt/tm/shared/sys/backup/
    and check the status of the job.

    Once completed you could retrieve it using SCP if needed.

    Thanks.

    Josh