Unexpected failover, ipsec_ha_unit_mask_changed

[Dennis_Kloosterman]

Hi,

I have tried troubleshooting an unexpected failover between two BigIP's using F5's troubleshooting guide, but was unable to find anything relevant.

I did find a line in the tmm log of both devices that scores 0 results on Google:

Formerly active device:

<13> Apr  7 01:19:54 [device name removed] notice ipsec_ha_unit_mask_changed/159: PFKDB: Box is ACTIVE now!

Formerly standby device:

<13> Apr  7 01:20:06 [device name removed] notice ipsec_ha_unit_mask_changed/174: PFKDB: Box becames STANDBY

"becames" is not a type, it's copied from the log.

Does anyone have an idea what this means?

[jaikumar_f5]

Can you goto your log and grep the below,

zcat /var/log/ltm* | grep "action is"

[Dennis_Kloosterman]

Hi,

This gives 0 results on both devices.

[youssef1]

Hello,

First of you have to determine what's happened for this follow recomendation of this KB:

https://support.f5.com/csp/article/K95002127

In this kb it advise you to check LTM logs (just be carreful when failover it's happendm maybe you can't see this event in ltm logs and you have to check in old archive with zcat):

egrep -i 'failover|failsafe' /var/log/ltm

zcat /var/log/ltm* | grep 'failover|failsafe'

Then very important check if you have a core file generated around failover time (Apr 7 01:19:54) in /var/core/ directory.

https://support.f5.com/csp/article/K10062

Last point generate a qkview in order to load it in ihealth:

https://ihealth.f5.com/

BIG-IP iHealth is the qkview file technology, which provides a running snapshot of your BIG-IP system with up-to-the-minute configuration and diagnostic information. You can quickly download a qkview file from your BIG-IP system, and then upload the file to the BIG-IP iHealth system.

The BIG-IP iHealth system translates the output from your qkview file and displays the content in a customer-friendly format that mimics the familiar BIG-IP Configuration utility. In addition to translating the raw data, the BIG-IP iHealth Diagnostics component of the BIG-IP iHealth system evaluates the logs, command output, and configuration of your BIG-IP system against a database of known issues, common mistakes, and published F5 best practices.

Regards

[Ford_Prefect]

Hi, Dennis

Did you succeed with finding the root cause of the issue?

[Dennis_Kloosterman]

Hi Ford,

I haven't, but we upgraded to 12.1.5.1 a few months ago and I haven't seen this behaviour since.