For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Anthony's avatar
Anthony
Icon for Nimbostratus rankNimbostratus
Dec 01, 2015

Removed iApp - now can't config-sync

I've been having a tidy up today on our production loadbalancers. This involved removing some unused APM iApps.

One of them seems to have left a load of 'apm policy policy-item' entries in the bigip.conf, and the config-sync now fails with the following message:

Dec  1 14:02:22  notice mcpd[6141]: 01071038:5: Loading keys from the file.
Dec  1 14:02:25  warning mcpd[6141]: 010712e9:4: Resuming log processing at this invocation; held 22 messages.
Dec  1 14:02:25  warning mcpd[6141]: 010712e9:4: pva.syncookies.connectionthreshold is not in BigDB.dat.
Dec  1 14:02:25  warning mcpd[6141]: 010712e9:4: pva.listeners.dest.maxentries is not in BigDB.dat.
Dec  1 14:02:25  warning mcpd[6141]: 010712e9:4: pva.adaptivereaper.scrubperiodms is not in BigDB.dat.
Dec  1 14:02:25  warning mcpd[6141]: 010712e9:4: pva.syncookies.serverwindow is not in BigDB.dat.
Dec  1 14:02:25  warning mcpd[6141]: 010712e9:4: md.maxtransactionperaggrphase is not in BigDB.dat.
Dec  1 14:02:25  warning mcpd[6141]: 010712e9:4: Per-invocation log rate exceeded; throttling.
Dec  1 14:02:25  err mcpd[6141]: 01070277:3: The requested access policy item (/Common/Citrix_APM.app/Citrix_APM_apm_securid) was not found.
Dec  1 14:02:25  err mcpd[6141]: 01071488:3: Remote transaction for device group /Common/Sync-Failover-Group to commit id 126 6223315446436815030 /Common/..com 0 failed with error 01070277:3: The requested access policy item (/Common/Citrix_APM.app/Citrix_APM_apm_securid) was not found..
Dec  1 14:02:25  notice mcpd[6141]: 01071038:5: Loading keys from the file.
Dec  1 14:02:25  notice mcpd[6141]: 01071038:5: Master Key updated by user %cmi-mcpd-peer-192.168.84.2
Dec  1 14:02:26  notice mcpd[6141]: 010714a0:5: Sync of device group /Common/device_trust_group to commit id 126 6223315446438941225 /Common/..com 0 from device /Common/..com complete.

Anyone seen this sort of behaviour before, or know of a way to get around it? I am starting to think that manually removing the items from the bigip.conf and forcing a load via tmsh is the only way.

Thanks in advance,

Anthony

application delivery
BIG-IP Access Policy Manager (APM)
iApps

3 Replies

  • mikeshimkus_111's avatar
    mikeshimkus_111
    Historic F5 Account
    Dec 01, 2015

    Hi Anthony, I have seen this behavior before with a couple of our APM iApps. We have a bug for tracking it, but no resolution yet.

     

    You can and should remove those policy items using tmsh, not by manually editing bigip.conf. You could do that by logging into tmsh, running "cd /Common/Citrix_APM.app", then running "delete apm policy policy-item" against the items you want to delete (the delete command accepts wildcards, as well).

     

  • Jinshu's avatar
    Jinshu
    Icon for Cirrus rankCirrus
    Dec 01, 2015

    Hi Mate,

     

    This is common issue in iApp. You need to delete the iAPP configuration manually from the .conf files and load it.

     

    1. Copy the .conf files to your local system. Open it with notepad++ and find the configurations for your iapp.
    2. Delete it manually from the conf file.
    3. Take backup of the existing conf file.
    4. Copy it to the F5 and run load tmsh verify
    5. If verification success, run the command load tmsh (filename)

    Make sure that you have deleted everything from the conf file before you load the conf file.

     

    This is not a recommended way but only option to get out of this kind of problems at this point of time.

     

    Let me know if you need any help on this.

     

    -Jinshu

     

  • Anthony's avatar
    Anthony
    Icon for Nimbostratus rankNimbostratus
    Dec 02, 2015

    I carried out the steps you recommended and it has allowed us to config-sync once again.

     

    Thanks for your suggestion!