For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Sani's avatar
Sani
Icon for Nimbostratus rankNimbostratus
Dec 06, 2016

What could be the reason for the APM log "user=root folder=/Common module=(tmos)# status=[Command OK] cmd_data=list sys db"

Hello Everyone,   I see the following entry in APM logs every 10 minutes. Is this Normal? Can someone give some info about why this message appear in the logs.   Nov 28 12:11:02 F5-APM notice ...
application delivery
BIG-IP Access Policy Manager (APM)
LTM
Lucas_Thompson_'s avatar
Lucas_Thompson_
Historic F5 Account
Dec 06, 2016

These are normal. Example from a lab box:

Dec  6 08:31:02 current-3 notice tmsh[6922]: 01420002:5: AUDIT - pid=6922 user=root folder=/Common module=(tmos) status=[Command OK] cmd_data=show sys mcp-state field-fmt
Dec  6 08:31:02 current-3 notice tmsh[6933]: 01420002:5: AUDIT - pid=6933 user=root folder=/Common module=(tmos) status=[Command OK] cmd_data=list sys db
Dec  6 08:41:01 current-3 notice tmsh[7372]: 01420002:5: AUDIT - pid=7372 user=root folder=/Common module=(tmos) status=[Command OK] cmd_data=show sys mcp-state field-fmt
Dec  6 08:41:02 current-3 notice tmsh[7383]: 01420002:5: AUDIT - pid=7383 user=root folder=/Common module=(tmos) status=[Command OK] cmd_data=list sys db
Dec  6 08:51:01 current-3 notice tmsh[7818]: 01420002:5: AUDIT - pid=7818 user=root folder=/Common module=(tmos) status=[Command OK] cmd_data=show sys mcp-state field-fmt
Dec  6 08:51:02 current-3 notice tmsh[7829]: 01420002:5: AUDIT - pid=7829 user=root folder=/Common module=(tmos) status=[Command OK] cmd_data=list sys db

If you'd rather not see these, I'd suggest to submit a ticket to Support to make a request to remove/hide them.