F5 v11.2 and syslog-ng

We have been having some stability issues with our F5 after upgrading them to 11.2. We had no such issues in the lab but for some reason production does not behave exactly the same as the lab no matter how much we try to make it the same.

F5 support was baffled and even replaced our unstable unit. EUD report was clean so replacing the unit was only done because of the lack of other explanation.

After a day with the replacement unit the same unstable behavior started. Reboots every 15 minutes or so.

A member of my team figured out that the unit syslog-ng was having an issue with the tcp connection to a remote server. Syslog-ng would lose the connection and start consuming all the CPU resources. Eventually the F5 OS decides that it is time to reboot because other processes can’t complete their task.

We have since migrated the sysloging to UDP which shows no signs of the issue.

F5 support is asking us to test a fix where they have upgraded syslog-ng from 2.0.8 to 2.1.4. This fix is based on 11.2.0 HF1 which is a bit odd since HF2 has been out for a little while.

Can’t find this error message on Google or Bing

error_string         : 01070712:3: Caught configuration exception (0), Invalid monitor rule instance identifier: 47 – ltm/validation/MonitorRule.cpp, line 1323

I am trying to troubleshoot some error I am getting with my F5 iControl application and it seems that no one ever encountered this issue before.

Hard to believe.

I posted a question on the DevCentral Forums hoping to get some help but I am managing my expectations that others have faced this exact problem.

I have found a post that has the “Invalid monitor rule instance identifier” portion but the solution is to open a case with F5 support which I have also done.

F5 Support informed me that this error meant that in my configuration (bigip.conf) there was an issue on line 1323.  I find this error misleading because I was expecting the error was with the MonitorRule.cpp on line 1323. After looking at the configuration I could not figure out anything wrong. I did a QkView (for support) and everything started to work again. This makes absolutely no sense but since it is working I can’t troubleshoot anymore.