HA pair UCS backups - file sizes very different from each other

[Fallout1984]

I've noticed with a few of the UCS backup files I'm pulling from some HA pairs that the file size of one may be larger than the other (50-100 meg) and I'm trying to figure out why. These are ones with APM licensed. Earlier I deleted all but the most current anti-virus update packages on each, so it's not that. Any idea what else I could look at? I tried comparing the actual UCS file contents, but there are so many folders and subfolders I gave that idea up.

Thanks!

[CA_Valli]

UCS files are a backup of the local appliance, and as such they contain data that have not been syncronized across a device group and data that are not part of the sync operation.

For example, you might have packet captures on one appliance, or ISO files, or maybe a user might have scripts saved in his home directory. None of this will be syncronized to the other appliance.

Text configuration files are in /config/ and /config/partitions/<p.name>/ folders , you can easily unzip them and check their sizes/content to confirm nothing's missing. (Of course, bigip_base.conf files are local-only)

If you have physical access to the appliance you can also run ls -al /config to find out what file sizes are.

[Fallout1984]

Thanks! I'll try comparing the two VMs using "ls -al /config" and see what that looks like.

[Fallout1984]

I picked out two VMs to check and the files sizes were similar. I also checked their /var/tmp folders and didn't see a real difference there either. It's odd, but yes somewhere there are some files that aren't synced between the two. As the culprits all have APM licensed on them, I suspect the answer may lie with that.

[jaikumar_f5]

The way I'd check is like this,

• Generate a ucs and save it on /var/tmp/
• Create a folder in /var/tmp/test/
• Move the ucs from /var/tmp/ to /var/tmp/test/
• Untar the UCS file in the /var/tmp/test by running below command
  • tar -xvf <ucs-file-name>.ucs
• Run find command inside the /var/tmp/test to see which file is consuming the highest space.
  • find /var/tmp/test -xdev -type f -exec du {} \; | sort -rn | head -20

This is will tell you the top consuming file.

[Fallout1984]

Using your instructions, I checked one of the VM pairs and found three epsec files (ex. epsec-1.0.0-489.0.iso_41872_1) that remained after I'd cleaned them out a while back. Looking at the GUI, I see only the latest one and haven't been able to determine where the three stray files are "hiding."

[jaikumar_f5 · Accepted solution]

Yea I've seen it too. U gotta use the cli to delete them.

Follow this article & Then generate a new UCS and see if it's less size.

https://support.f5.com/csp/article/K25633150

[Fallout1984]

Got it. I'll do that - thanks! 😀

[Fallout1984]

That took care of it by the way - thanks for the tip!

[jaikumar_f5]

That's why we got the community 🙂 Glad could be of help, cheers !​