For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Fallout1984's avatar
Fallout1984
Icon for Cirrocumulus rankCirrocumulus
Nov 08, 2021
Solved

HA pair UCS backups - file sizes very different from each other

I've noticed with a few of the UCS backup files I'm pulling from some HA pairs that the file size of one may be larger than the other (50-100 meg) and I'm trying to figure out why. These are ones with APM licensed. Earlier I deleted all but the most current anti-virus update packages on each, so it's not that. Any idea what else I could look at? I tried comparing the actual UCS file contents, but there are so many folders and subfolders I gave that idea up.

 

Thanks!

  • Yea I've seen it too. U gotta use the cli to delete them.

    Follow this article & Then generate a new UCS and see if it's less size.

    https://support.f5.com/csp/article/K25633150

9 Replies

  • UCS files are a backup of the local appliance, and as such they contain data that have not been syncronized across a device group and data that are not part of the sync operation.

     

    For example, you might have packet captures on one appliance, or ISO files, or maybe a user might have scripts saved in his home directory. None of this will be syncronized to the other appliance.

     

    Text configuration files are in /config/ and /config/partitions/<p.name>/ folders , you can easily unzip them and check their sizes/content to confirm nothing's missing. (Of course, bigip_base.conf files are local-only)

     

    If you have physical access to the appliance you can also run ls -al /config to find out what file sizes are.

     

     

    • Fallout1984's avatar
      Fallout1984
      Icon for Cirrocumulus rankCirrocumulus

      Thanks! I'll try comparing the two VMs using "ls -al /config" and see what that looks like.

    • Fallout1984's avatar
      Fallout1984
      Icon for Cirrocumulus rankCirrocumulus

      I picked out two VMs to check and the files sizes were similar. I also checked their /var/tmp folders and didn't see a real difference there either. It's odd, but yes somewhere there are some files that aren't synced between the two. As the culprits all have APM licensed on them, I suspect the answer may lie with that.

  • The way I'd check is like this,

    • Generate a ucs and save it on /var/tmp/
    • Create a folder in /var/tmp/test/
    • Move the ucs from /var/tmp/ to /var/tmp/test/
    • Untar the UCS file in the /var/tmp/test by running below command
      • tar -xvf <ucs-file-name>.ucs
    • Run find command inside the /var/tmp/test to see which file is consuming the highest space.
      • find /var/tmp/test -xdev -type f -exec du {} \; | sort -rn | head -20

     

    This is will tell you the top consuming file.

     

    • Fallout1984's avatar
      Fallout1984
      Icon for Cirrocumulus rankCirrocumulus

      Using your instructions, I checked one of the VM pairs and found three epsec files (ex. epsec-1.0.0-489.0.iso_41872_1) that remained after I'd cleaned them out a while back. Looking at the GUI, I see only the latest one and haven't been able to determine where the three stray files are "hiding."

      • jaikumar_f5's avatar
        jaikumar_f5
        Icon for Noctilucent rankNoctilucent

        Yea I've seen it too. U gotta use the cli to delete them.

        Follow this article & Then generate a new UCS and see if it's less size.

        https://support.f5.com/csp/article/K25633150