Forum Discussion
Cirrussyslog-ng anf errdefsd service err
Hi Forrest-Z ,
Check quickly if there are core files generated recently, follow this article : https://my.f5.com/manage/s/article/K10062
if you found any of core files , you must open a case with F5 Support to allow them review the core dump file and let you know the RCA for this issue, no one other than F5 Support can help you in Core files analysis.
By the way, I have reproduced this issue in my lab and as you said
errdfsd keeps restarting and mcpd takes most of CPU also I felt with some degradation overall.
It was solved by rebooting BIGIP, so I believe if you rebooted it this will free the CPU.
I don't see any other workarounds for this, but as I said you can reach out to F5 support team to know the RCA for this.
Cirrushi :
My device is out of maintenance time and can't be rebooted for a while, I killall syslog-ng and restarted syslog-ng to free up the CPU usage of the mcpd service. But I can't do anything about the constant rebooting of errdfsd, but I found that bigstart stop errdefsd stopping the errdefsd service stops the cyclic reboot problem.
Hi ,
I believe that you need to prepare rebooting your BIGIP.
I think when you used bigstart stop errdefsd this stops the restarting but still mcpd takes the most of CPU.
without errdefsd you have a problem in Logging.- Forrest-Z
hi thanks a lot for your reply!您好，非常感谢您的回复！
In my testing I found that the problem that was causing the high CPU utilization of mcpd was a fake dead syslog-ng service. After I killall syslog-ng and restart syslog-ng, mcpd CPU utilization is back to normal. syslog-ng is normal, ltm log is able to output logs normally. errdefsd is a HSL log, and I don't use HSL log at the moment. I have been observing it in the test environment for two days and I didn't find any other abnormality.在我的测试中，我发现导致 mcpd 高 CPU 使用率的问题是假死的 syslog-ng 服务。在我杀死所有 syslog-ng 并重新启动 syslog-ng 后，mcpd CPU 利用率恢复正常。 syslog-ng正常，ltm log能够正常输出日志。 errdefsd是一个HSL日志，我目前不使用HSL日志。我在测试环境观察了两天，没有发现其他异常。
