Applies To:
Show VersionsBIG-IP AAM
- 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.5, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0, 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1, 11.6.0, 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
BIG-IP Analytics
- 17.1.2, 17.1.1, 17.1.0, 17.0.0, 16.1.5, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0, 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.4, 11.6.3, 11.6.2, 11.6.1, 11.6.0, 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
BIG-IP Link Controller
- 17.1.2, 17.1.1, 17.1.0, 17.0.0, 16.1.5, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0, 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1, 11.6.0, 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
BIG-IP LTM
- 17.1.2, 17.1.1, 17.1.0, 17.0.0, 16.1.5, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0, 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1, 11.6.0, 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
BIG-IP AFM
- 17.1.2, 17.1.1, 17.1.0, 17.0.0, 16.1.5, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0, 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1, 11.6.0, 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
BIG-IP FPS
- 17.1.2, 17.1.1, 17.1.0, 17.0.0, 16.1.5, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.0, 14.1.5, 14.1.4, 14.1.3, 14.1.0, 14.0.0, 13.1.5, 13.1.4, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6
BIG-IP DNS
- 17.1.2, 17.1.1, 17.1.0, 17.0.0, 16.1.5, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0, 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0
BIG-IP Distributed Cloud Services
- 17.1.2, 17.1.1, 17.1.0
BIG-IP APM
- 17.1.2, 17.1.1, 17.1.0, 17.0.0, 16.1.5, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0, 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1, 11.6.0, 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
BIG-IP GTM
- 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1, 11.6.0, 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
BIG-IP Advanced WAF
- 13.1.1, 13.1.0
BIG-IP PEM
- 17.1.2, 17.1.1, 17.1.0, 17.0.0, 16.1.5, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0, 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1, 11.6.0, 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
BIG-IP ASM
- 17.1.2, 17.1.1, 17.1.0, 17.0.0, 16.1.5, 16.1.4, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 16.0.1, 16.0.0, 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 14.0.1, 14.0.0, 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0, 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1, 11.6.0, 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
Log Messages List
ID Number | Description |
00020000 | Resuming log processing at this invocation; held %d messages. |
01010001 | %s starting |
01010004 | Memory allocation failed: %s |
01010007 | "Config error: %s" |
01010011 | Persistence cookie hash failed |
01010013 | database size increased by %d bytes, %d total |
01010019 | Caught signal %d, exiting |
01010020 | MCP Connection %s, exiting |
01010027 | Unable to attach to PCI device %02x:%02x.%02x |
01010028 | No members available for pool %s |
01010029 | Clock advanced by %u ticks |
01010038 | Syncookie counter %d exceeded vip threshold %u for virtual = %A:%d |
01010040 | Clock has unexpectedly adjusted by %lld ms |
01010044 | "%s feature %s licensed" |
01010045 | Bandwidth utilization is %d Mbps, exceeded %d%% of Licensed %d Mbps |
01010054 | tmrouted connection %s |
01010056 | Syncookie counter %d exceeded vip threshold %u for virtual = %s |
01010201 | Inet port exhaustion on %*A to %*A%c%d (proto %d) |
01010213 | L3 Address LB method deprecated; using 'Least Connections' for pool %s |
01010216 | DNSSEC: Signature failed (%s) for RRSET (%s, %lu) with key %s, generation %llu. |
01010221 | Pool %s now has available members |
01010225 | Failure to query dns-express db (%s) |
01010231 | DNSSEC: Did not add RRSIGs to response RR set (owner: %s). |
01010235 | Inet port find called for pg %d with invalid cmp state %x |
01010239 | LSN error: %s |
01010240 | Syncookie HW mode activated, server = %A:%d, HSB modId = %d |
01010241 | Syncookie HW mode exited, server = %A:%d, HSB modId = %d from %s |
01010250 | Pool member %A:%u exceeded configured rate limit. |
01010251 | Virtual %s exceeded configured rate limit. |
01010259 | External Datagroup (%s) %s. |
01010260 | Hardware Error(%s): %s %s |
01010273 | Access policy Configuration object: [%s] not found |
01010274 | Access Policy and Access Policy Item join failed: [%s] not found |
01010276 | FTPS warning: Security policy disabled for %A%%%u:%u due to explicit FTPS mode negotiation |
01010290 | TCP: Memory pressure activated |
01010291 | TCP: Memory pressure deactivated. Dropped %llu packets, %llu bytes |
01010300 | BDoS: (TMM) Histogram (%p) %s for context %s (ref cnt %d). |
01010301 | BDoS: (TMM) %s failure for context %s - %s (error %s). |
01010302 | BDoS: (TMM) %s signature (%s) for context %s at idx %u (detection=%u mitigation=%u state=%s transient=%s retired=%s). |
01010303 | BDoS: (TMM) signature (%s) removed (at idx %u of signature table) from context %s. |
01010305 | BDoS: (TMM) afm_provisioned=%s dos_provisioned=%s l4_bdos_licensed=%s bdos_feature_enabled=%s detection=%s |
01010307 | Memory allocation failed: %s %s |
01010308 | Access Policy update: %s End Txn Failed (%d) |
01010309 | Access Policy(%s) update: Subroutine properties can be only assigned to Access policy of type subroutine |
01010310 | Incomplete hud chain for listener: %s |
01010311 | Failed to configure VDI-enabled listener %s: %En |
01010313 | Profile %s create failed. |
01010314 | profile %s update: bad profile |
01010315 | Agent [%s] update: Invalid event validate |
01010316 | Agent [%s] update: agent clone failed |
01010317 | Agent [%s] update: agent store failed |
01010318 | Agent [%s] update: agent construct failed |
01010322 | pem protocol profile gx modify {%s}: invalid |
01010323 | {%s, %s}: protocol message cannot be deleted, error %E |
01010324 | {%s, %s}: not found, cannot modify. |
01010325 | pem protocol profile radius modify {%s}: invalid |
01010326 | {%s, %s}: protocol message cannot be deleted, error %E |
01010327 | {%s, %s}: not found, cannot modify. |
01010328 | BDoS: (TMM) afm_provisioned=%s dos_provisioned=%s dns_bdos_licensed=%s detection=%s |
01010329 | BDoS: (TMM) Signature %s: threshold_mode=%s detection=%u mitigation_curr=%llu |
01010330 | Failed to register the Neuron App %s with the Neuron client |
01010331 | Neuron client %s failed with %s(%s) |
01010332 | Neuron application %s registered |
01010342 | Disabled TCP HW checksum offloading automatically disables TCP Segmentation Offload (TSO) |
01010343 | Syncookie SW mode activated, server = %A:%d |
01010344 | Syncookie SW mode exited, server = %A:%d |
01010346 | [LTM LB][%C]%s |
01010347 | DynaD activated |
01010348 | DynaD inactivated |
01010348 | Access Policy(%s) update: Customization group set can be only assigned to Access policy of type per-request |
01010349 | DNSSEC: Failed to parse DS record string (%s): %s |
01010355 | DNS: Awaiting full DNSSEC Key %s Generation %llu from MCP |
01010356 | %s: filter '%s' init failed. |
01010364 | Hybrid fixed-policy setting change: from %d to %d. |
01010365 | DNSSEC: Invalid value specified for DB variable %s. Using default value. |
01010371 | CMP state discrepancy between blades detected, forcing maintenance mode. Unable to relinquish maintenance mode until event clears or feature (tmm.cdp.requirematchingstates) is disabled. |
01010372 | CMP state discrepancy between blades cleared or feature (tmm.cdp.requirematchingstates) disabled, relinquishing maintenance mode. |
01020037 | The requested %s (%s) already exists |
01020066 | The requested %s (%s) already exists in partition %s |
0102006e | IP Address %s is invalid with netmask %s, must not be the same as network address. |
0102006f | The string does not contain only space separated integers between 0 and 4294967295 |
01060001 | Service detected %s for %s:%u monitor %s. |
01060002 | Node address detected %s for %s monitor %s. |
01060110 | Lost connection to mcpd with error %d, will reinit connection. |
01060111 | Open SSL error - %s |
01060136 | Received links up - monitoring starts. |
01060145 | Pool %s member %s monitor status %s. [ %s ] [ %s ] |
01060146 | Bigd PID %d, instance %d, overloaded. |
01060156 | Bigd PID %d, instance %d, fail to serialize 'bigd=>mcpd' message (exceed msg-length limit?): %s. |
01060157 | Receive string cannot be empty for reverse monitor '%s' |
01060158 | Disable string must be empty for reverse monitor '%s' |
01070007 | Received shutdown signal %d |
01070043 | Monitor %s parent not found. |
0107004e | LTM configuration is not allowed when VCMP is provisioned. Virtual server %s conflicts with VCMP. |
01070069 | Subscription not found in mcpd for subscriber Id %s. |
01070147 | Snatpool %s must reference at least one translation address. |
01070151 | Rule [%s] error: %s |
01070165 | "License file stat fails: %s." |
01070259 | Requested member (%s) is untagged on another VLAN |
0107025d | Nameserver for Wide IP Zones (%s) is not a fully qualified domain name or contains invalid characters. |
0107025e | Nameserver for Wide IP Zones is empty. A valid, fully qualified domain name must be specified. |
01070261 | Can't create a home directory for username %s (%s) |
01070265 | The %s (%s) cannot be deleted because it is in use by a %s (%s) |
01070277 | The requested %s (%s) was not found |
0107028a | The source address (%s) for virtual server (%s) must have a prefix length. |
01070301 | Pool (%s) is referenced by one or more virtual servers |
0107030c | Host persistence requires an HTTP profile to be associated with the virtual server |
01070315 | profile %s requires a key |
01070318 | The requested media %s for interface %s is invalid. |
01070320 | Snatpool %s is still referenced by a virtual server. |
0107032f | The vlan (%s) associated with the static route %s/%d must have a Self IP using the IPv%u protocol. |
01070340 | %s (%s) is referenced by one or more rules |
01070341 | Virtual server %s references rule %s which does not exist. |
01070354 | Self IP %s / %s: This network is defined on two vlans (%s and %s) |
01070356 | %s feature not licensed |
01070392 | Self IP %s / %s: This IP shares a network with %s (%s / %s). |
01070394 | %s in rule (%s) requires an associated %s profile on the virtual server (%s) |
01070404 | Add a new Publication for publisherID %s and filterType %p |
01070406 | Removed publication with publisher id %s |
01070407 | Removed information for Publication %s and filterType %p |
01070408 | Deleting abandoned subscriber connection for %s |
01070410 | Removed subscription with subscriber id %s |
01070413 | Updated existing subscriber %s with new filter class %llx |
01070417 | AUDIT - user %s - transaction #%u-%u - object %u - %s |
01070418 | connection %p (user %s) was closed with active requests |
01070419 | Platform initialization phase triggered |
01070421 | Base configuration initialization phase triggered. |
01070424 | Full configuration initialization phase triggered. |
01070427 | Initialization complete. The MCP is up and running |
01070465 | DB changed: %s, configsync needed |
01070466 | Received end of platform data |
01070468 | %s |
01070596 | An unexpected failure has occurred, %s, exiting... |
01070599 | Current management-ip (%s) has to be deleted before adding a new management-ip (%s) with the same address family. |
01070604 | Cannot delete IP %s because it would leave a route unreachable. |
01070608 | License is not operational (expired or digital signature does not match contents) |
01070622 | The monitor %s has a wildcard destination service and cannot be associated with a node that has a zero service |
01070638 | "Pool %s member %s:%u monitor status %s." |
01070639 | Pool %s member %s:%u session status %s. |
01070640 | Node %s address %s monitor status %s. |
01070690 | Port mirroring is not supported on this platform. |
0107070e | Software version not covered by service agreement. Reactivate license before continuing. |
01070712 | "Caught configuration exception (%d), %s." |
01070727 | "Pool %s member %s:%u monitor status up." |
01070728 | Node %saddress %s monitor status up. |
01070730 | Configuration restored from binary image |
01070734 | Configuration error: %s |
01070736 | Couldn't write to the user/role/partition file, %s (%d) |
01070756 | Diameter monitor '%s' has invalid mode '%s' |
01070807 | Monitor %s instance %s:%u has been %s. |
01070822 | "Access Denied: %s" |
01070823 | Read Access Denied: %s |
01070827 | User login disallowed: %s |
01070830 | The iRule (%s) cannot be deleted because it is in use by a %s (%s) %s (%s). |
01070921 | Virtual Server '%s' on partition '%s' %s by user '%s'. |
01070927 | Request failed, data provider (%s) disconnected from mcpd |
01070931 | Clustering quorum reached |
01070933 | License blob received from primary. |
01070967 | The specified vlan, vlangroup or tunnel (%s) cannot be removed from its default route domain (%s). |
01070978 | The vlan (%s) for the specified self IP (%s) must be one of the vlans in the associated route domain (%s). For example: 192.168.0.1%1234 for self IP in route-domain 1234. |
01070979 | The specified vlan (%s) for route domain (%s) is in use by a self IP. |
01070995 | get_tmstat: tmstat_sample not ready. Statsd may not be running. |
01071027 | Master key OpenSSL error: %s |
01071029 | %s |
0107102d | Cannot load master key file. Updating to a new master key. |
01071031 | %s |
01071038 | %s |
01071047 | Removing %d %s local objects from slot %d |
01071070 | Failed to %s file %s with error %d |
01071138 | The access policy (%s) has an action/macrocall item (%s) that is referenced by any rule's next item for %d time(s). Exactly one reference is allowed. |
01071246 | "Unable to reload the dns cache\n" |
010712a5 | Ha_group %s unknown %s %s. |
01071321 | Vlan allowed mismatch found: hypervisor (%s:%s), guest (%s:%s) and (%s:%s). |
01071392 | Background command '%s' failed. %s |
010713b1 | Cannot delete IP (%s) because it is used by the system state-mirroring (%s) setting. |
010713b8 | Propose change to system hostname (%s). |
010713ba | Propose change to default gateway (%s). |
010713bc | Propose change to management IP address (%s/%s). |
010713c0 | System state ready for hypervisor mgmt settings: (%s) |
010713c1 | Initial management network proposals triggered (%s) |
010713c2 | No new proposal values detected |
010713c3 | Hypervisor updating %s. Old value: (%s) New value: (%s). |
010713f6 | CentMgmt objects must be in the '/Common' folder |
01071412 | Cannot delete IP (%s) because it is used by the system config-sync setting. |
0107142f | Can't connect to CMI peer %s, %s |
01071430 | Cannot create CMI listener socket on address %s, port %d, %s |
01071431 | Attempting to connect to CMI peer %s port %d |
01071432 | CMI peer connection established to %s port %d after %d retries |
01071434 | No CMI peer devices configured |
01071435 | Disconnecting from CMI peer %s as a result of a reconfiguration |
01071436 | CMI listener established at %s port %d |
0107143a | CMI reconnect timer: %s |
0107143b | CMI connection debug info: %s |
0107143c | Connection to CMI peer %s has been removed |
01071451 | Received CMI hello from %s |
0107146f | Self-device %s address cannot reference the non-existent Self IP (%s); Create it in the /Common folder first. |
01071470 | Disconnecting from CMI device %s, the device is not in a trust domain |
0107147f | Could not read certificate file (%s) |
01071485 | %s (%s) content does not match the signature. |
01071488 | Remote transaction for device group %s to commit id %llu %llu %s %llu failed with error %s |
0107149c | Virtual server %s has more than one clientssl/serverssl profile but none of them is default for SNI. |
010714a0 | Sync of device group %s to commit id %llu %llu %s %llu from device %s complete |
01071515 | Unclassified domain logging on %s requires log publisher to be set. |
01071528 | Device group '%s' sync inconsistent, %s. |
01071539 | Mcpd is starting. The BIG-IP version is %s |
01071587 | Commit ID message ignored, %s |
010715bc | "The application service (%s) has strict updates enabled, the object (%s) must be updated using an application management interface." |
01071653 | Failed to create the (%s). The maximum allowable length of %d for name has been exceeded. The object name was (%s). |
0107167d | Data publisher not found or not implemented when processing request %s. |
01071681 | SNMP_TRAP: Virtual %s has become available |
01071682 | SNMP_TRAP: Virtual %s has become unavailable |
0107168c | Incremental sync complete: This system is updating the configuration on device group %s device %s from commit id { %llu %llu %s } to commit id { %llu %llu %s }. |
0107168e | Unable to do incremental sync, reverting to full load for device group %s device %s from commit id { %llu %llu %s } to commit id { %llu %llu %s }. |
010716b3 | A draft policy (%s) can not be applied to ACL rule (%s). |
010716b4 | Policy %s cannot be assigned to %s, because %s. |
010716e3 | Policy '%s'; an action precedes conditions in another rule. |
0107172d | Policy '%s' can't be applied to virtual server '%s' because it has no rules |
01071764 | HA order list in traffic group (%s) cleared because there is no self failover device group. |
0107179a | Setting DB variable %s to %s. Reboot is required for changes to take effect. |
010717b3 | Setting DHCP request-option to none can result in management-ip misconfiguration and loss of management connectivity. |
010717b6 | %s can only be used in one LSN pool or security nat source translation object. The PCP Server %s (%s) is in use by lsn pool %s. |
010717dc | VXLAN tunnel remote address can be configured only as any(0.0.0.0) with flooding types none and multipoint. |
010717e2 | Client SSL profile (%s): must have at least one set of %s. |
0107183b | Cannot disable LDNS cache when a Wide IP has persistence enabled. |
01071860 | Cannot enable feed list %s. Maximum number of enabled feed list allowed is %d. |
01071863 | OCSP cert-validator (%s): DNS resolver and proxy server pool can not be both empty. |
01071864 | OCSP cert-validator (%s): The certificate (%s) can not be used by an OCSP cert-validator as a %s, because it is currently using some cert-validator (%s) to monitor its status. |
01071865 | Unable to find an HTTP-based OCSP responder URL that is configured in the OCSP cert-validator (%s) or in the AIA (Authority Information Access) extension of the certificate (%s). |
01071866 | OCSP cert-validator (%s): Please specify a HTTP-based absolute URL for the OCSP responder. |
01071867 | OCSP cert-validator (%s): Both key and certificate should be specified for signing the OCSP request. |
01071868 | OCSP cert-validator (%s): Only prime256v1 named curve is supported for signer key. |
01071869 | OCSP cert-validator (%s): Security type %s is not supported for signer key. |
0107186a | OCSP cert-validator (%s): Signer key (%s) and signer certificate (%s) do not match. |
010718e1 | Only the standard-balanced-fpga firmware type is permitted in vCMP mode. |
010718e3 | Certificate (%s) has enabled OCSP at cert-validation-option but is not associated with any OCSP cert-validator. |
010718e4 | OCSP cert-validator (%s): can not use both DNS resolver and proxy server pool. Please ensure that only one of them is configured. |
01071909 | Anti-Fraud publisher '%s' is required to be with one destination of type '%s'. |
0107190a | Field '%s' cannot be empty in the Anti-Fraud profile '%s'. |
01071911 | %s in rule (%s) are not allowed under %s event on the %s (%s). |
01071912 | %s in rule (%s) requires an associated %s profile on the %s (%s). |
01071913 | %s in rule (%s) under %s event at %s (%s) does not satisfy cmd/event/profile requirement. |
01071918 | CMI device (%s) has a different version (%s) from this device (%s). |
010719a8 | URL parameters can be %s only when %s is enabled in the Anti-Fraud profile '%s'. |
010719ac | Parameter cannot be %s while it is %s in the Anti-Fraud profile '%s'. |
010719b7 | URL whitelist words can be selected only from malware blacklist words in the Anti-Fraud profile '%s'. |
010719b7 | Anti-Fraud DOM signature '%s'(hash ID) cannot be deleted as it appears in the DOM signatures whitelist in the Anti-Fraud profile '%s' (Anti-Fraud URL: '%s'). |
010719c9 | Unicast address warning (FAILOVER MAY NOT WORK): %s should be a mgmt (blade) address or non-floating self IP. |
010719d6 | The location '%s' cannot have empty path between leading '/' and file extension or trailing '/', and also cannot contain only '/' and '.' in the Anti-Fraud profile '%s'. |
010719e7 | Virtual Address %s general status changed from %s to %s. |
010719e8 | Virtual Address %s monitor status changed from %s to %s. |
010719ea | GTM changed state from %s to %s. |
010719fd | No IPv%s self IP exists on VLAN (%s) for static route (%s) |
01071a01 | URL parameters can appear only in POST request when Mobile encryption is enabled in the Anti-Fraud profile '%s'. |
01071a14 | device_trust_group: Requesting device data from device %s. |
01071a15 | device_trust_group: Sending device data to device %s. |
01071a37 | Anti-Fraud %s '%s' was created as %s and this setting cannot be changed. |
01071a38 | Wildcard %ss must have unique priorities in the Anti-Fraud profile '%s'. |
01071a39 | Cannot %s of explicit %s in the Anti-Fraud profile '%s'. |
01071a6e | Incompatible options - traffic group %s cannot have both auto-failback-enabled and the failover-method set to ha-score |
01071a85 | Wildcard URL cannot have %s enabled in the Anti-Fraud profile '%s'. |
01071a95 | Admin IP (%s/%s): Gateway (%s) for management route (%s) is not in a connected network. |
01071a9a | The '%s' for interface %s has been adjusted to '%s'. |
01071aa6 | %s bad actor cannot be enabled if per-source detection/limit pps is less than 1% of the DoS vector (%s) %s setting for %s. |
01071aa7 | %s bad actor per-source detection/limit pps cannot be greater than the Dos vector (%s) %s setting for %s. |
01071acc | Cannot enable maintenance mode when device is forced offline. |
01071acd | The requested device (%s) was not found in self failover device group (%s). |
01071ad3 | The requested provision module (%s) is not compatible with already provisioned module (%s). |
01071ad4 | LSN pool %s shares the same name as security nat source translation object. LSN iRules that take in 'pool name' as an argument would default to LSN objects |
01071ad9 | Security NAT Source Translation object %s shares the same name as LSN pool. LSN iRules that take in 'pool name' as an argument would default to LSN objects. |
01071af3 | URL parameters cannot be entangled for Mobile while no parameter is encrypted for Mobile in the Anti-Fraud profile '%s'. |
01071af8 | The firewall rule UUID cannot be modified by user once it's created. |
01071af8 | The firewall rule UUID (%s) already exists in other rules. |
01071af9 | The specified firewall rule UUID (%s) is diffrent from exists rule UUID. |
01071aff | AOM webui is not available in this release. |
01071b00 | AOM vkvm is not available in this release. |
01071b1d | The %s (%s) cannot be created because the %s secret generation failed due to (%s). |
01071b27 | Scope name cannot be empty for OAuth Authorization agent %s. |
01071b28 | Scope name (%s) associated with OAuth Authorization agent (%s) is not defined under OAuth scope. |
01071b29 | %s entry refers to invalid OAuth Authorization agent %s, entry %d. |
01071b2c | The client app (%s) that is associated with the %s (%s) does not exist. |
01071b3b | Notice: Purging initiated for OAuth DB Instance (%s). Time taken for DB purging depends on the amount of data; BIG-IP performance may be affected during this time. Only expired tokens will be removed. |
01071bad | The certificate (%s) can not simultaneously use a cert-validator (%s) and be configured as the %s of a cert-validator (%s). |
01071bbd | SSL profile (%s): When CRL configuration name (%s) is specified, both static CRL file (%s) and Allow-Expired-CRL settings are not allowed. |
01071bcd | Security NAT Source Translation object (%s) cannot use both Self IP and DSLITE tunnel for PCP configuration. |
01071bd1 | Inbound CMI connection from IP (%s) denied because it came from VLAN (%s), not from expected VLAN (%s). |
01071bd6 | %s (%s): Cannot enable Device-ID without enabling Bot Signatures and the 'Search Engine' Bot Signature Category. |
01071bd8 | The tag-mode for requested member %s has to be 'none' on platforms that do not support QinQ. |
01071be4 | port-fwd-mode value of interface (%s) is not compatible with vlan (%s) member interface (%s). |
01071be5 | Member interface (%s) of trunk (%s) not found. |
01071be6 | port-fwd-mode value of interface (%s) is not compatible with trunk (%s) member interface (%s). |
01071bed | The URL (%s) belongs to Custom Category (%s) has invalid type as regex-match and not supported yet. |
01071bee | SSLv2 is no longer supported and has been removed. The 'sslv2' keyword in the cipher string has been ignored. |
01071bf0 | Vlan %s c-tag %s is out of range. |
01071bf1 | Vlan %s tag %d is out of range. |
01071bf6 | Cannot change FIPS name on busy guest: %s. |
01071bf7 | Invalid URL format %s in CA-bundle manager %s. Check help page. |
01071bf8 | Bundle manager %s cannot use a certificate file object %s that depends on itself. This would cause a cyclic dependency. |
01071bf9 | CA-bundle management trace: CA-bundle %s depends on %s. |
01071bfa | CA-bundle manager %s does not exist. |
01071bfb | The default CA-bundle manager %s cannot be deleted. |
01071bfc | The default CA-bundle manager %s cannot be changed. |
01071bfd | The default CA-bundle manager %s cannot change the exclude-url or exclude-bundle sets. |
01071bfe | The port number must be removed from %s, and set separately. |
01071bfe | %s: %s can't be deleted because %s. |
01071bff | The trusted CA-bundle must be provided in CA-bundle manager %s in order to download from URLs. |
01071c00 | The requested certificate file object %s for %s was not found. |
01071c01 | Object %s cannot be used in both include and exclude sets in CA-bundle manager %s. |
01071c02 | CA-bundle URL %s in CA-bundle manager %s only supports HTTPS. |
01071c03 | F5 CA-bundle %s cannot be dynamically managed. |
01071c04 | Cannot find device group (%s). |
01071c05 | Cannot find Policy Sync object definition file (%s). |
01071c06 | Cannot find Policy Sync object list file (%s). |
01071c07 | Cannot find Policy Sync data file (%s). |
01071c08 | Cannot determine whether agent type %s is appropriate for access policy (%s) of type %s because it is not attached to apm profile access using access-policy property. |
01071c09 | Cannot determine whether agent type %s is appropriate for access policy (%s) of type %s because visibility is not properly defined. |
01071c0a | Cannot determine whether agent type %s is appropriate for access policy (%s) of type %s parent of access policy (%s) of type %s because it is not attached to apm profile access using access-policy property. |
01071c0b | Cannot determine whether agent type %s is appropriate for access policy (%s) of type %s parent of access policy (%s) of type %s because visibility is not properly defined. |
01071c0c | Categories can't be assigned without selecting dynamic bwc policy. |
01071c0d | Default attribute consuming service (%s) must be present in the list 'attribute-consuming-services' of apm saml aaa (%s) |
01071c0e | Attribute consuming service session variable and object cannot be configured at the same time in agent (%s) |
01071c0f | Attribute consuming service variable (%s) in agent (%s) is not in session variable format |
01071c10 | 'attribute-name' must be configured for attribute (%s) in attribute-consuming-service (%s) |
01071c11 | All attribute names must be unique within attribute-consuming-service (%s). Provided attribute name (%s) is not unique |
01071c12 | attribute-consuming-service (%s) must specify at least one attribute |
01071c13 | attribute-consuming-service-index (%d) in aaa saml server (%s) conflicts with index of existing service (%s). Please provide unique index. |
01071c14 | 'service-name' value must be configured in attribute-consuming-service (%s) |
01071c15 | aaa saml server must be configured before attribute consuming service can be specified |
01071c16 | SAML agent (%s) specifies attribute consuming service (%s) that is not configured in aaa saml server (%s) |
01071c18 | Attribute consuming service (%s) cannot be removed from aaa saml server (%s) because service is set as default |
01071c19 | The requested username source (%s) is not a valid session variable. |
01071c1a | The requested password source (%s) is not a valid session variable. |
01071c1b | Virtuals Servers in the same listener group can have different profiles. Modifying the profiles in the listener will not update the profiles in the Virtual Servers. To update the profiles in Virtual servers, modify the Virtual Servers individually. |
01071c1c | You cannot delete the nodejs version (%s). |
01071c1d | You cannot modify the nodejs version (%s). |
01071c1e | Cannot perform Protocol inspection update: %s |
01071c1f | Protocol Inspection compliance inspection %s requires valid value: %s |
01071c20 | Too many Protocol Inspection profiles. Up to %d supported. |
01071c22 | Modifying predefined Protocol Inspection profiles are not allowed. |
01071c23 | Creating predefined Protocol Inspection profiles are not allowed. |
01071c24 | Deleting predefined Protocol Inspection inspections are not allowed. |
01071c25 | Modifying predefined Protocol Inspection inspections are not allowed. |
01071c27 | Protocol Inspection internal error: %s. |
01071c28 | Invalid Protocol Inspection snort signature: %s. |
01071c2a | Creating/Modifying Protocol Inspection compliance enums are not allowed. |
01071c2b | Deleting Protocol Inspection services are not allowed. |
01071c2c | Creating/Modifying Protocol Inspection services are not allowed. |
01071c2d | The VLAN (%s) tag is %u. The port-fwd-mode value of %s (%s) must be set to (%s). |
01071c2e | The VLAN (%s) can have at most %u member because member (%s) port-fwd-mode value is (%s). |
01071c2f | The requested VLANGROUP (%s) can have at most %u member(s) because VLAN members have virtual-wire members. |
01071c30 | Vlan (%s) is not compatible with member vlan in VLANGROUP (%s). |
01071c31 | The VLANGROUP (%s) mode and the VLAN (%s) member (%s) port-fwd-mode are not compatible. |
01071c32 | The VLANs must have the same tag in VLANGROUP (%s) when they have l2wire member. |
01071c32 | The VLANs must have the same tag in VLANGROUP (%s) when they have virtual-wire member. |
01071c33 | The VLAN (%s) tag (%u) cannot be modified %s '4096'. |
01071c34 | The requested member (%s) is already configured as a member of VLAN (%s) with tag (%d). A member can belong to only one VLAN for a given tag. |
01071c34 | The requested member (%s) is already configured as a member of VLAN (%s) with tag (%u). A member can belong to only one VLAN for a given tag. |
01071c35 | The VLAN (%s) has %s interface while the VLAN (%s) has %s interface. Interfaces of VLANs that are in the same 'virtual-wire' VLANGROUP (%s) must have the same taggedness. |
01071c36 | The SelfIP (%s) cannot associate with %s (%s) with (%s) interface. |
01071c37 | %s: %s is not supported on this platform (%s). |
01071c38 | Rule Profiler object %s requires log publisher to be specified. |
01071c38 | Modify of ephemeral %s (%s) is not permitted. |
01071c3a | Route MTU for (%s) below minimum %u. |
01071c3a | Invalid FQDN node %s: %s. |
01071c52 | Routing object (%s) cannot have both items: %s. |
01071c55 | Invalid as-path (%s): %s. |
01071c56 | Invalid as-path entry (%s) for as-path (%s): %s. |
01071c58 | Virtual server %s is in ALG mode. Must not use static source translation, as used by attached profile %s. |
01071c5c | Cannot disable AJAX encryption for URL '%s' while parameter '%s' has AJAX mapping enabled in the Anti-Fraud profile '%s'. |
01071c5c | AJAX encryption or both AJAX integrity and strong integrity must be enabled for URL '%s' while parameter '%s' has AJAX mapping enabled in the Anti-Fraud profile '%s'. |
01071c5d | AJAX mapping '%s' for parameter '%s' cannot start or end with a '.' in the Anti-Fraud profile '%s' (Anti-Fraud URL: '%s'). |
01071c5e | Anti-Fraud parameter '%s' is invalid. Enabling AJAX mapping for parameter requires that either 1. AJAX encryption and either value substitution or Real-Time Encryption or parameter encryption enabled 2. Full and Enhanced AJAX Data Manipulation Check enabled in the Anti-Fraud profile '%s' (Anti-Fraud URL: '%s'). |
01071c5f | Cannot %s when %s in the Anti-Fraud profile '%s' (Anti-Fraud URL: '%s'). |
01071c60 | DynaD private key generation failed ('%s'). |
01071c61 | DynaD public key generation failed ('%s'). |
01071c62 | DynaD failed to decrypt private key. Re-generating. |
01071c63 | DynaD development mode requires an F5 development license. |
01071c64 | DynaD signature verification failed ('%s'). |
01071c65 | DynaD cannot activate unsigned instrumentation. |
01071c66 | The VLAN (%s) member (%s) must be tagged when the tag is '4096'. |
01071c67 | The PEM rating group id needs to be greater than Zero. Rating group %s cannot use rating group id %d because it is invalid. |
01071c68 | Profile %s's SSL client certificate constrained delegation CA key is missing. |
01071c69 | Profile %s's SSL client certificate constrained delegation CA cert is missing. |
01071c6a | Profile %s's SSL client certificate constrained delegation peer-cert-mode is invalid. |
01071c6b | Profile %s supports only RSA key and certificate for SSL client certificate constrained delegation. |
01071c6c | Profile %s's SSL client certificate constrained delegation key is missing. |
01071c6d | Profile %s's SSL client certificate constrained delegation CA key and certificate do not match |
01071c6e | PKCS11d (re)initialized. Re-connecting to network-HSM PKCS11d. |
01071c72 | Policy '%s', rule '%s'; %s SSL server profile %s not found. |
01071c73 | F5 Service Connector %s validation error: %s. |
01071c74 | F5 MFA Configuration %s validation error: %s. |
01071c75 | F5 MFA User Verification Agent %s validation error: %s. |
01071c76 | F5 MFA Device Registration Agent %s validation error: %s. |
01071c77 | Issuer is required for JWT config (%s). |
01071c78 | Invalid %s (%s) in JWT config (%s). The value %s. |
01071c79 | Self-issued token is not allowed (%s) for JWT config (%s). |
01071c7a | In JWT config (%s), same signing algorithm is present in both allowed signing algorithms and blocked signing algorithms. This is not allowed. |
01071c7b | OAuth Provider (%s) references OAuth JWT Config (%s) that does not exist. |
01071c7c | When key-type is '%s', '%s' must be present for jwk-config (%s). |
01071c7d | The JWK config (%s) with key-type '%s' cannot contain an empty '%s'. |
01071c7e | The field (%s) is not relevant to key-type '%s' and thus cannot be present for jwk-config (%s). |
01071c7f | Certificate key file must be referenced when passphrase is present for jwk-config (%s). |
01071c80 | JWT access token lifetime (%u) for %s (%s) must be in range of (%u-%u). |
01071c81 | JWT refresh token lifetime (%u) for %s (%s) must be in range of (%u-%u). |
01071c82 | OpenID Connect Configuration Endpoint URL (%s) for %s (%s) must end with (%s). |
01071c83 | (%s) (%s) load failed due to %s |
01071c85 | (%s) key-type (%u) does not match certificate (%s) type (%u). |
01071c86 | The %s must be provided in base64url encoded format for jwk-config (%s). |
01071c87 | The claim name (%s) of claim (%s) cannot contain spaces. |
01071c88 | The word (%s) is a reserved word and cannot be used as claim name for the claim (%s). |
01071c89 | The %s claim name (%s) is already in use by agent %s for this entry. |
01071c8a | The %s claim (%s) that is associated with the %s (%s) does not exist. |
01071c8b | The %s claim name cannot be empty for OAuth Authorization agent %s. |
01071c8c | %s claim name (%s) associated with OAuth Authorization agent (%s) is not defined under OAuth claim. |
01071c8d | %s cannot be empty because %s for %s (%s). |
01071c8e | %s in %s (%s) is not an allowed URL: %s |
01071c8f | The %s (%s) associated to %s (%s) is not a valid %s. |
01071c90 | JWT config %s to be associated with JWK config (allowed keys) %s does not exist. |
01071c91 | In JWT config %s, allowed keys '%s' do not exist. Use a valid JWK config for allowed keys. |
01071c92 | In JWT config (%s), the same JWK config (%s) is present in both allowed keys and blocked keys. This is not allowed. |
01071c93 | JWT config %s to be associated with JWK config (blocked keys) %s does not exist. |
01071c94 | In JWT config (%s), blocked keys '%s' do not exist. Use a valid JWK config for blocked keys |
01071c95 | JWT Provider List %s to be associated with OAuth Provider %s does not exist. |
01071c96 | In JWT Provider List %s, OAuth Provider %s does not exist. Use a valid OAuth Provider for providers attribute. |
01071c97 | Error generating JWT encryption key using secret. |
01071c98 | The JWK config (%s) associated to %s (%s) can contain public key types only (such as, rsa, elliptic-curve). |
01071c99 | The OAuth profile (%s) does not allow JWK config (%s) with duplicate key-id (%s) of type (%s). |
01071c9a | The JWK config (%s) containing algorithm (%s) does not match key type (%s). |
01071c9b | The JWK config (%s) associated to %s (%s) contains an invalid signing algorithm. |
01071c9c | The JWK config (%s) associated to %s (%s) can only be used for signing. |
01071c9d | The JWK config (%s) associated to %s (%s) requires certificate key configuration. |
01071c9e | The encryption secret is needed to generate an encryption key for OAuth profile (%s). |
01071c9f | Allowed signing algorithms list cannot be empty in JWT config (%s) for Issuer (%s). |
01071ca0 | When the %s flag is enabled, OAuth Provider (%s) must have %s JWT config attached for the JWT provider list (%s) |
01071ca1 | The JWK config (%s) associated to %s (%s) was auto-generated and is meant for Client/Resource Server purposes only. |
01071ca2 | When jwt-token is enabled, a JWK config must be assigned as the Primary Key for OAuth Profile (%s). |
01071ca3 | Error loading cert-chain (%s) associated to JWK config (%s)%s |
01071ca4 | Invalid certificate order within cert-chain (%s) associated to JWK config (%s). |
01071ca5 | The JWK config (%s) associated to OAuth %s (%s) failed trust verification with trusted CA bundle (%s). |
01071ca6 | Only '%s' token validation mode is allowed for OAuth %s agent '%s'. |
01071ca7 | JSON web token '%s' already exists in Provider List '%s'. The change you are trying to make is not allowed because it would result in a provider list that contains more than one instance of the same JSON web token. |
01071ca8 | JSON web key '%s' already exists in Provider List '%s'. The change you are trying to make is not allowed because it would result in a provider list that contains more than one instance of the same JSON web key. |
01071ca9 | OAuth parent profile's jwt-refresh-token-enc-secret attribute cannot be modified. |
01071caa | The encryption key for OAuth profile (%s) cannot be specified directly. Use encryption secret to generate a new encryption key and make sure that jwt-token is enabled. |
01071cab | The JWK config (%s) associated to %s (%s) requires key ID configuration. |
01071cac | When more than one JWK config of key-type '%s' is present in a JWT config, all the keys of that key-type must have key-id or cert-thumbprint-sha1 or cert-thumbprint-sha256 present. |
01071cad | All the JWK configs in a JWT config must have unique key-id for each key-type. The key-id '%s' for key-type '%s' is already present in JWT config '%s'. |
01071cae | %s (%s) for OAuth profile (%s) should be unique across other OAuth Authorization Server endpoints. |
01071caf | The issuer cannot be modified for autodiscovered JWT config '%s'. |
01071cb0 | Cannot enable Real-Time Encryption when a custom encryption function is specified in the Anti-Fraud URL '%s'. |
01071cb0 | For autodiscovered JWT config '%s', you can move algorithms between the allowed and blocked lists only. |
01071cb1 | JWK config '%s' is autodiscovered, JWT config '%s' is not. An autodiscovered JWK config can be added to an autodiscovered JWT config only. |
01071cb2 | For autodiscovered JWT config '%s', you can move autodiscovered keys between the allowed and blocked lists only. |
01071cb3 | Autodiscovered JWK config '%s' cannot be modified. |
01071cb4 | Autodiscovered JWT config cannot be modified for OAuth Provider '%s'. |
01071cb5 | Autodiscovered JWT config '%s' is associated with OAuth Provider '%s'. It cannot be added to Provider '%s'. |
01071cb6 | Support for at least Opaque or JWT token should be enabled for OAuth profile (%s). |
01071cb7 | The auto-generated attribute for %s '%s' cannot be modified. |
01071cb8 | The auto-generated attribute for %s '%s' cannot be specified. |
01071cb9 | Claim value cannot be empty for OAuth claim (%s). |
01071cba | %s claim value associated with OAuth claim (%s) cannot be empty for OAuth Authorization agent %s, entry %d. |
01071cbb | The JWK config (%s) containing algorithm (%s) does not match curve (%s) for elliptic-curve. |
01071cbc | The last-discovery-time cannot be specified while creating Provider '%s'. |
01071cbd | The last-discovery-time cannot be modified for Provider '%s'. |
01071cbe | When use auto JWT config is enabled, OAuth Provider (%s) must have trusted CA present. |
01071cbf | The JWK Config (%s) cert field cannot be empty if cert-key (%s) is specified. |
01071cc0 | %s (%s): Traffic Scrubbing Advertisement Duration must be more than zero. |
01071cc1 | %s (%s): RTBH Advertisement Duration must be more than zero. |
01071cc2 | Cannot enable both %s and %s for parameter '%s' in the Anti-Fraud profile '%s' (Anti-Fraud URL: '%s'). |
01071cca | Dos Signature (%s): %s is not user settable field. |
01071ccb | %s (%s): Attacked dst can not be enabled if per-destination detection/limit pps is less than 0.1%% of the corresponding vector setting. |
01071ccc | %s (%s): Attacked dst per-destination detection/limit pps cannot be greater than the corresponding vector setting. |
01071cd4 | %s: %s can't be deleted because %s. |
01071cd5 | %s: %s can't be modified because %s. |
01071cd6 | Dos Signature (%s): %s is not allowed to be reset by user once it is specified. |
01071cd9 | Field-list contains an invalid/duplicate value. |
01071cdc | Security static PAT %s translation object '%s' address (%s) is overlapping with another address (%s) located in '%s' PAT %s translation object. |
01071cdd | Traffic-group (%s) is referenced by security NAT Policy (%s) and cannot be deleted. |
01071cde | Traffic-group (%s) is referenced by security source translation (%s) and cannot be deleted. |
01071cdf | %s (%s): Dos vector (%s) does not support Attacked destination DOS attack detection. |
01071ce3 | %s (%s) cannot be set to (%s) when %s (%s) is set to (%s) |
01071ce4 | %s (%s): %s feature is not supported for %s attack type. |
01071ce5 | %s (%s): %s cannot be enabled if %s is not enabled for %s attack type. |
01071ce6 | The value (%s) is invalid. Valid TTL is %s. |
01071ce7 | Cannot configure Advertisement TTL while scrubbing is in progress. |
01071ce8 | The VLAN %s has the same tag %u as VLAN %s. So the port-fwd-mode of the interface associated with the VLAN must be set to l2wire. |
01071ce8 | The VLAN (%s) has the same tag %u as VLAN (%s). So the port-fwd-mode of the interface associated with the VLAN must be set to virtual-wire. |
01071ce9 | The Scrubber Route Domain (%s) has a destination IP (%s) that overlaps with (%s). |
01071ceb | Operation failed for CA bundle manager %s due to other pending operation. |
01071cec | Ignoring unknown tag (%u) in %s message. |
01071ced | MQTT monitor '%s' must have a username when password is configured. |
01071cee | Virtual %s cannot use FastL4 hash persistence profile %s when protocol is not TCP. |
01071cef | Policy (%s) of type %s cannot have subroutine-properties attached, policy type must be %s. |
01071cf0 | DNS resolver must be configured for SAML metadata automation object (%s). |
01071cf1 | SAML metadata automation object (%s) should have only one 'connection-properties' attribute configured. |
01071cf2 | apm sso saml (%s) contains empty value in saml-attribute (%s). |
01071cf3 | Authorize redirect request (%s) must always use 'GET' method. |
01071cf4 | Invalid %s for Monitor Test (%s) conflicts with monitor value (%s) |
01071cf5 | Invalid state (%s) for Monitor Test target (%s) marked for cleanup |
01071cf6 | The current provisioning does not support the TurboFlex profile. Please provision LTM first or choose another profile suggested on the help page. |
01071cf7 | The chosen turboflex is not licensed, therefore the change cannot be made. |
01071cf9 | The provision module %s requires TurboFlex profile %s. Please either un-provision the module or choose the required profile. For more information, please see 'tmsh help sys turboflex' on the command line, or look at the 'Help' tab on the TurboFlex page under Resource Provisioning. |
01071cfb | Please get the Advanced Protocols or FIX add-on license to enable FIX features. |
01071cfc | %s changing OpenSSL FIPS flag from (%d) to (%d). Reboot is required for changes to take full effect. |
01071cfc | %s changing OpenSSL FIPS flag from (%d) to (%d). Reboot is required for changes to take full effect. |
01071cfd | The VLAN (%s) tag %u cannot be modified to %u once the VLAN is created. Please delete and re-create it. |
01071cfe | %s (%s): AutoMitigate %s %u must be lower than AutoMitigate ceiling %u. |
01071cff | %s (%s): AutoMitigate %s 'infinite' must be lower than AutoMitigate ceiling %u. |
01071d00 | Maximum response size (%u) for OAuth provider (%s) must be in range of (%u-%u). |
01071d01 | Invalid value (%s) for profile %s field %s. Only integers between 0 and 4294967295 are permitted. |
01071d02 | Size of field '%s' for monitor '%s' exceeds allowed maximum of %d bytes. |
01071d03 | Encryption object is too big. |
01071d04 | Encryption failed. |
01071d05 | %s is not a valid IP address or hostname. |
01071d06 | Overlapping %s IP addresses (%s) is in NAT policy '%s', rule '%s'. |
01071d07 | The VLANGROUP (%s) is composed of VLAN (%s) of tag %u with %s member (%s). A similar VLANGROUP must be created first and be composed of VLAN of tag '4096' with member (%s). |
01071d08 | Connectivity profile (%s) does not exist. |
01071d09 | Management auto-lasthop (%s) can't be disabled on a 1-NIC platform. |
01071d09 | Invalid multicast address '%s' specified for multicast-ip. |
01071d0a | adm: %s |
01071d0a | Policy (%s) of type %s cannot have per-req-policy-properties attached, policy type must be %s. |
01071d0b | adm: %s |
01071d0b | Configuration error: Virtual Server (%s) with Access Profile of type sslo is not compatible with profile of type (%s). |
01071d0c | adm: %s |
01071d0c | Configuration error: Access Profile of type sslo is not compatible with exchange profile. |
01071d0d | adm: %s |
01071d0d | Configuration error: Virtual server (%s) cannot be used for connector profile (%s), type must be internal. |
01071d0e | Global ASM health alerts configurations error: %s |
01071d0e | Configuration error: Connector profile (%s) cannot be attached to virtual server (%s) when per-request policy (%s) is attached to this virtual server. Attach service connect agent to the per-request policy instead. |
01071d0f | Configuration error: Virtual server (%s) used by connector profile (%s) must have a service profile attached. |
01071d10 | Configuration error: Virtual server (%s) used by connector profile (%s) with inline service profile (%s) must have a splitsession client profile attached. |
01071d12 | Cannot delete the Anti-Fraud URL '%s' since it is referenced by the Anti-Fraud View '%s' in the Anti-Fraud Profile '%s'. |
01071d13 | Anti-Fraud Base URL '%s' must exist before creating the Anti-Fraud View '%s' in the Anti-Fraud Profile '%s'. |
01071d14 | '%s' can be modified only for a 'Base URL', while the Anti-Fraud URL '%s#%s' is a 'View URL' in the Anti-Fraud Profile '%s'. |
01071d15 | Configuration error: access log configuration (%s) is part of system configuration, so it cannot be deleted. |
01071d16 | DNS profile (%s) cannot have both edns0 client subnet insertion and the DNS cache enabled simultaneously. |
01071d16 | Configuration error: sslo log configuration (%s) is part of system configuration, so it cannot be deleted. |
01071d17 | DNS profile (%s) inherits options from DNS profile (%s) and cannot have both edns0 client subnet insertion and the DNS cache enabled simultaneously. |
01071d18 | The IP::port(%s:%d) to be dedicated, can't be shared. Refer pools(%s, %s) |
01071d19 | The IP(%s) to be dedicated, can't be shared. |
01071d1a | The dedicated snatpool member address (%s) matches a selfip address (%s) |
01071d1b | The VIP(%s) needs pool(%s) or snatpool(%s) as dedicated for Accelerated traffic only |
01071d1b | Virtual server (%s) requires clientssl profile when the ftps-mode in FTP profile (%s) is require. |
01071d1c | The VIP(%s) in DSR mode, expect source-address-translation type(%d) as none |
01071d1d | The TrafficAcceleration profile(%s) does not support persist-mode(%d) |
01071d1e | The VIP(%s) does not support persistence profiles(%s) because it is dedicated for traffic-acceleration |
01071d1f | The VIP(%s) does not support last hop pools because it is dedicated for traffic-acceleration |
01071d20 | The Pool(%s) does not support load-balancing mode(%u) because it is in use for traffic-acceleration |
01071d23 | MQTT multiple peers on %s %s not supported. |
01071d24 | MQTT %s %s refers to non-existing %s %s. |
01071d25 | \'%s\' at rule %s is %s by virtual server %s of type %s. |
01071d25 | Error configuring Virtual Server (%s). Connection mirroring is not supported in combination with an IMAP profile. |
01071d26 | Error configuring Virtual Server (%s). Connection mirroring is not supported in combination with an POP3 profile. |
01071d27 | Error parsing SAML assertion consumer service url: (%s) in SAML SP connector (%s) |
01071d28 | 'sp-location' in SAML SP connector (%s) is set to internal-multi-domain, but the virtual server where SP is located is not specified in 'multi-domain-location' property. |
01071d28 | Virtual server (%s) requires clientssl profile (%s) to enable SSL forward proxy when FTP profile (%s) is present. |
01071d29 | Multidomain location (%s) of SAML SP connector (%s) is invalid: (%s). Location must begin with http or https and must contain hostname with no path. |
01071d29 | Virtual server (%s) requires clientssl profile (%s) to enable SSL verified handshake when FTP profile (%s) is present. |
01071d2a | Cipher rule (%s): '%s' is not a valid %s. |
01071d2a | When OpenID Connect is enabled for OAuth profile (%s) and the alg type for %s primary key (%s) is 'HS512', the client secret for all associated Client apps with OpenID Connect enabled should be of size 64 bytes. Please re-generate the client secret for Client app (%s). |
01071d2b | ID token lifetime (%u) for %s (%s) must be in range of (%u-%u). |
01071d2b | Virtual server (%s) cannot have connector profiles when allow-active-mode in FTP profile (%s) is enabled. |
01071d2c | When OpenID Connect is enabled, a JWK config must be assigned as the ID Token Primary Key for OAuth Profile (%s). |
01071d2d | When OpenID Connect is enabled, support for JWT token should be enabled for OAuth profile(%s). |
01071d2f | The OAuth profile (%s) does not allow JWK config (%s) with duplicate key-id (%s) of type (%s) within UserInfo Primary Key and Rotation Keys. |
01071d30 | OAuth claim (%s) has invalid value (%s). For '%s' claim, allowed value is a numeric value or a valid session variable. |
01071d31 | Authentication type for Client app (%s) is not valid. When OpenID Connect is enabled for OAuth profile (%s) and the key type for %s primary key (%s) is 'octet', then all associated Client apps with OpenID Connect enabled should have the authentication type as 'Secret'. |
01071d32 | The OAuth profile (%s) does not allow JWK config with duplicate key-id (%s) of type (%s) within %sPrimary Key (%s) and %sPrimary Key (%s). |
01071d33 | JWK config (%s) cannot be configured to use both client secret and shared secret for key type octet. |
01071d34 | In JWT config (%s), the %s JWK config (%s) cannot be configured to use client secret when key type is octet. |
01071d36 | JWK config (%s) is %sconfigured to use client secret for key type octet. Hence, this cannot be used as %s primary key in %s (%s). |
01071d36 | The prefix (%s) is a reserved word and claim name (%s) cannot be used for the claim (%s). Please remove or change the prefix to continue. |
01071d37 | %s claim (%s) cannot be associated with %s (%s) since the claim name is 'address'. Please create and associate claims with claim name (street_address, locality, region, postal_code, country) that are sub-fields of this claim. |
01071d38 | %s claim (%s) cannot be associated with OAuth Authorization agent (%s), entry (%d) since the claim name is 'address'. Please create and associate claims with claim name (street_address, locality, region, postal_code, country) that are sub-fields of this claim. |
01071d39 | The claim name of the Claim (%s) cannot be changed to 'address' because this claim is part of %s claims that is associated with %s (%s). Please create and associate claims with claim name (street_address, locality, region, postal_code, country) that are sub-fields of this claim. |
01071d3a | The claim name of the Claim (%s) cannot be changed to 'address' because this claim is part of %s claims that is associated with OAuth Authorization agent (%s), entry (%d). Please create and associate claims with claim name (street_address, locality, region, postal_code, country) that are sub-fields of this claim. |
01071d3b | %s claim (%s) cannot be associated with %s (%s). The claim value must be set to 'true', 'false' or a valid session variable. |
01071d3c | %s claim (%s) cannot be associated with OAuth Authorization agent (%s), entry (%d). The claim value must be set to 'true', 'false' or a valid session variable. |
01071d3d | The claim value must be set to 'true', 'false' or a valid session variable for Claim (%s) when it is attached to %s claims on %s (%s). |
01071d3e | The claim value must be set to 'true', 'false' or a valid session variable for Claim (%s) when it is attached to %s claims on OAuth Authorization agent (%s), entry (%d). |
01071d3f | Can't find prime AVR-profile. |
01071d40 | Can't generate more than %d %s when collecting AVR statistics. |
01071d41 | Can't generate a list of %s because 'collect_%s' flag is disabled. |
01071d41 | Anti-Fraud View '%s' is invalid. View must be non-empty string with size less than %u and should contain only valid characters in the Anti-Fraud Profile '%s'. |
01071d42 | Can't generate list of counties because the '%s' is invalid. |
01071d43 | Can't generate list of urls because the '%s' URL's length is exceeded maximum %1d. |
01071d44 | The Traffic Matching Criteria (%s) is already in use by another Netflow Protected Server (%s). |
01071d44 | Invalid type %s for %s %s. All the %s should be the same type (IPv4 ot IPv6). |
01071d45 | Invalid Netflow Protected Server [%s] name for stopping redirection |
01071d45 | Discovery interval (%u) for OAuth provider (%s) must be greater than (%u) minutes. |
01071d46 | Netflow Protected Server (%s) cannot have a Traffic Matching Criteria that references a route domain. |
01071d47 | (%s) has an invalid mask %u. |
01071d49 | Specified compatibility level-%d is too high. That level includes feature settings that are not supported for this platform. |
01071d4a | Security FlowSpec: %s: router-id(%s) is not a valid IPv4 address. |
01071d4b | Security FlowSpec: %s: %s (%s) has mis-matched route domain (%d). |
01071d4c | Route domain (%s) can not have both 'Security Flowspec BGP' and 'Zebos BGP' routing planes enabled at the same time. |
01071d4d | Security FlowSpec: %s: missing required field(s) %s. |
01071d4e | Security FlowSpec: %s: must have at least one 'neighbor' specified. |
01071d4f | Security FlowSpec: %s: The datatype (%d) for inherited fields is missing. |
01071d50 | Security FlowSpec: %s: %s is non-mutable field. |
01071d51 | Security FlowSpec: %s: %s doesn't have matched address family. |
01071d52 | The attribute (%s) for (%s) cannot be none. |
01071d54 | The value (%lld) for attribute (%s) for (%s) must be within range %s. |
01071d55 | Security FlowSpec: %s: can not refer route domain (%s) which is neither in the same partition as profile nor in /Common partition. |
01071d56 | Limit on the number of extended white list entries (%u) has been reached. Please modify the value of dos.maxewlsize to allow more entries. |
01071d57 | The %s (%s) attribute %s can only reference objects in partition %s. |
01071d59 | Cannot modify scrubber config property %s |
01071d5a | IPv4/IPv6 Next hop must be configured. |
01071d5b | Not a valid %s Address. |
01071d5c | Cannot lower compatibility level. Whitelist address-list (%s) configured on this system requires current compatibility level. |
01071d5f | Entry already exist in extened white list(%s). |
01071d60 | %s failed with an I/O error: %s. |
01071d61 | Failed to allocate memory at %s:%d. |
01071d62 | CMI device (%s) attempted to connect but is running an incompatibly old version of TMOS. |
01071d62 | Unsupported route-type (%d) seen for mgmt-route (%s). |
01071d63 | CMI device (%s) attempted to connect but is running a version of TMOS with incompatible version (%s) (expected %s). |
01071d63 | No value specified for supersede-option: %s |
01071d65 | DNSSEC External Zone (%s) must be a descendant of DNSSEC Zone (%s). |
01071d65 | Invalid name value (%s) specified for URL Category %s. |
01071d66 | DNSSEC External Zone (%s:%s) duplicates existing DNSSEC zone (%s) with the same name (case-insensitive and unique across folders). |
01071d66 | System iRule (%s) cannot be associated to oauth server (%s). |
01071d67 | DNSSEC External Zone (%s:%s) duplicates existing external zone (%s:%s) with the same name (case-insensitive). |
01071d67 | Provider type F5 only supports introspect endpoint. |
01071d68 | DNSSEC External Zone (%s) references a nonexistent DNSSEC zone (%s) |
01071d68 | EntityID attribute of %s (%s) contains a session variable. SAML metadata exported by this object must be edited manually to replace session variables with valid hostnames before metadata is shared with external parties. |
01071d69 | DNSSEC Zone %s duplicates existing external zone (%s:%s) with the same name (case-insensitive). |
01071d69 | Frequency for SAML IdP automation (%s) cannot be zero. |
01071d6a | Unable to parse DNSSEC secure delegation record (%s:%s):%s (%s). |
01071d6a | At least one metadata URL must be configured for SAML SP metadata automation (%s). |
01071d6a | Client SSL profile (%s): Configured certificates are incompatible with TLS 1.3. |
01071d6b | DNSSEC secure delegation record (%s:%s) has DS with different owner name: %s. |
01071d6b | Frequency for SAML SP metadata automation (%s) cannot be zero. |
01071d6b | Client SSL profile (%s): Configured certificates are incompatible with TLS 1.3, so TLS 1.3 will not be negotiated. |
01071d6c | SAML SP metadata automation (%s) cannot be associated with sso saml (%s) because sso saml is already associated with SP automation (%s). SAML server can only be associated with one automation. |
01071d6c | Client SSL profile (%s): Some configured certificates are incompatible with TLS 1.3, so will not be used if TLS 1.3 is negotiated. |
01071d6d | SAML SP metadata automation (%s) specifies SAML SSO server (%s) that cannot be found on the system. |
01071d6d | IPv6 management addresses are unsupported in 1NIC mode. |
01071d6e | SAML SSO server (%s) associated SAML SP metadata automation (%s) are not in the same partition. |
01071d6f | SAML SP metadata automation (%s) contains invalid metadata URL value (%s). Error (%s). |
01071d6f | The Traffic Acceleration FPGA is not allowed when TAM is not provisioned. |
01071d70 | SAML SP metadata automation (%s) must have server SSL profile configured. |
01071d70 | LDAP config (%s) must either have a matching client certificate and client key, or both of these fields must be empty. |
01071d71 | SAML SP metadata automation (%s) must have DNS resolver configured. |
01071d71 | Can't create scheduled-report (%s). You currently have %u scheduled-reports set, while this is above the max allowed scheduled-reports (%u). |
01071d72 | Metadata URL (%s) value cannot be empty in SAML SP metadata automation (%s). |
01071d72 | %s. |
01071d73 | SAML SP metadata automation (%s) must specify value for sso-config-saml object. |
01071d73 | The Traffic Accelerated virtual(%s) is required to have a destination address set |
01071d74 | SAML SP metadata automation (%s) contains duplicated URL value (%s). |
01071d74 | Anti-Fraud URL '%s' is invalid. Only SPA URLs and their views can have destination URLs in the Anti-Fraud profile '%s'. |
01071d74 | Opening socket on interface %s failed: %s |
01071d75 | SAML SP connector (%s) cannot be deleted because it is managed by SP connector automation (%s). |
01071d75 | Db variable %s(%u) should be greater than %s(%u). |
01071d75 | %s IP for interface %s failed: %s |
01071d76 | SAML SSO config (%s) is assigned to a SAML resource (%s), and therefore can only have one SP connector object associated with it. |
01071d76 | FDB MAC %s cannot be broadcast/multicast |
01071d77 | SAML SSO configuration (%s) cannot specify both (%s) and (%s) at the same time. |
01071d78 | Attribute (%s) in %s (%s) must be in session variable format |
01071d79 | SAML Artifact Resolution Service (%s) is configured to sign requests. However, the correponding SAML SSO Config (%s) does not have signing %s configured. Please specify an IdP signing %s. |
01071d79 | Interface %s cannot be used in passive/virtual-wire mode. |
01071d7a | Master Key not yet ready. Delaying DNSSEC Key Generation Events for %u seconds. |
01071d7b | Cannot assign access profile and both clientssl and serverssl profiles with ssl proxy enabled to the same virtual server (%s). |
01071d83 | Failed to configure iptables rules for config sync CGC routing: %s |
01071d84 | Configured iptables rules for config sync CGC routing: %s |
01071d85 | Config sync over the management port requires big3d, which is not currently running. Config sync will not work until big3d is running. |
01071d93 | Unable to find customization source (%s) for customization group (%s). |
01071d93 | Profile %s the set Certificate Chain Traversal Depth (authenticate-depth), %u, is invalid. This must be 0 (infinite) or between 1 and %u inclusive. |
01071d93 | Single-ip %s - cluster member IP address %s cannot be configured for cluster %s. |
01071d94 | Bot Defense Profile (%s) Micro Service (%s): Missing required field (%s). |
01071d95 | Per-request access policy (%s) is not referenced by any existing customization group set |
01071d95 | FipsUserMgr Error: %s. |
01071d96 | Failed to send DDL to PostgreSQL: %s |
01071d96 | The customization group set (%s) cannot share an access policy (%s) with other customization group set (%s). |
01071d97 | Anti-Fraud URL '%s' is invalid. URL path cannot have trailing slashes in the Anti-Fraud Profile '%s'. |
01071d97 | Access policy name cannot be changed in customization group set (%s) |
01071d98 | Customization group set (%s) does not refer to access policy |
01071d98 | Empty IP protocol name specified for rule (%s). Please specify a valid string corresponding to the IP protocol number. |
01071d9b | PEM Gx/Sd reporting volume threshold cannot be smaller than 8K bytes. |
01071d9c | PEM Mandatory-Action-List cannot be set when Single-Rule-Match-Mode is disabled. |
01071d9d | Address Exclusion is not supported for Security NAT translation object (%s) of type %s. |
01071d9d | Neighbor entry (%s) can not be resolved%s. |
01071d9e | Bot defense anomaly %s not found. |
01071d9f | Bot defense anomaly category %s not found. |
01071d9f | %s. |
01071da0 | Bot defense class %s not found. |
01071da0 | %s. |
01071da1 | %s: When %s is (%s) and %s (%s) is %s address, %s (%s) represents '%s %s addresses'. |
01071da2 | Virtual Server %s's Traffic Matching Criteria %s illegally shares destination address, source address, service port, and ip-protocol with Virtual Server %s's Traffic Matching Criteria %s. |
01071da2 | Blacklist-category %s must have match type destination to enable scrubbing. |
01071da3 | Virtual Server %s's Traffic Matching Criteria %s illegally shares destination address, source address, service port, and ip-protocol with Virtual Server %s destination address, source address, service port. |
01071da3 | Cannot change match type to source or source-and-destination if scrubbing is enabled on the blacklist category. Disable scrubbing before changing the match type. |
01071da4 | Uri Type %s out of its minimum %d or maximum %d characters range. |
01071da5 | Uri Type must have at least %d %s associated with it. |
01071da6 | No more than %d total file extensions can be defined (across all Uri Types). |
01071da7 | No more than %d total Uri Types can be defined. |
01071da8 | File extension '%s' already exists in '%s' Uri Type. |
01071da9 | Uri Type objects must be in the '%s' folder only. |
01071daa | %s |
01071dac | Bot signature category %s not found. |
01071dac | Cannot change match type to destination or source-and-destination if blacklist publisher profile is attached to the category. |
01071dad | Bot defense profile (%s) class override (%s) error: %s. |
01071dad | Policy '%s', rule '%s'; target '%s' action '%s' cannot have same fallback pool (%s) and default pool (%s). |
01071dae | Bot Defense Profile (%s) Micro Service (%s): %s. |
01071dae | Policy '%s', rule '%s'; target '%s' action '%s' requires default pool. Please specify default pool along with fallback pool (%s). |
01071daf | Bot Defense Profile (%s) Micro Service (%s) Url (%s): %s. |
01071daf | Throwing Invalid Monitor Rule Instance: %s |
01071db0 | Throwing Invalid Monitor Rule Instance: %s |
01071db0 | %s %s. |
01071db1 | Bot defense profile (%s) Signature (%s) should be Mobile Application Class signature. |
01071db1 | Throwing Invalid Monitor Rule Instance: %s |
01071db2 | Bot defense signature category illegal class (%s). |
01071db2 | Throwing Invalid Monitor Rule Instance: %s |
01071db3 | Bot defense profile (%s) signature category override not supported for (%s) which belongs to (%s) class. |
01071db3 | Throwing Invalid Monitor Rule Instance: %s |
01071db4 | Bot defense profile (%s) signature override not supported for (%s) which belongs to (%s) class. |
01071db4 | Removing monitor rule instance: %s |
01071db5 | Bot defense profile (%s) Micro Service (%s) class override (%s) error: %s. |
01071db5 | Saving monitor rule instance: %s |
01071db6 | Bot defense profile (%s) error: %s. |
01071db6 | Creating a new monitor rule instance: %s |
01071dba | Warning (%s): %u bit keysize is insecure, it will be disabled in the future. |
01071dba | Cannot delete SSO configuration (%s) because it is referenced by a SSO configuration select agent (%s) |
01071dbc | Fail to commit due to the preset autodiscovery-enable VS number limit is %d. |
01071dbd | Fail to change the value to be less than the current number (%d) of VS that enables auto_discovery. |
01071dbf | Setting DB variable %s to %s. Restarting services. |
01071dbf | The requested otp source (%s) is invalid: %s |
01071dc0 | %s changing OpenSSL FIPS flag from (%d) to (%d). Restarting services. |
01071dc5 | The Group SIDs session variable name in AAA Kerberos agent (%s) is empty |
01071dc6 | The Group SIDs session variable name '%s' in AAA Kerberos agent (%s) is invalid |
01071dc7 | The %s session variable name in AAA Active Directory agent (%s) is empty |
01071dcd | Keytab file is not specified for AAA Active Directory Server (%s) |
01071dce | Service name is not specified for AAA Active Directory Server (%s) |
01071dd4 | DOS Profile (%s) cannot be attached to Zone as it is BDOS enabled. |
01071dd8 | SIP cannot be enabled on the DOS profile (%s) as it is already attached to zone. |
01071dd9 | VLAN (%s) cannot be attached to Zone (%s) as it is part of another Zone (%s) which is also has DOS profile attached. |
01071ddc | DOS Profile (%s) cannot be attached to the Zone as SIP is enabled on the profile. |
01071ddc | DOS Profile (%s) cannot be attached to the Zone (%s) as the profile has Bad Actor/Attacked Destination Detection enabled. |
01071dde | Log profile (%s) cannot be found. |
01071de0 | Dos profile (%s) cannot be attached to Protected-zone as BDOS is enabled. |
01071de3 | Vector Threshold Mode cannot be enabled on the DOS profile (%s) as it is already attached to a Protected-zone. |
01071de4 | DNS cannot be enabled on the DOS profile (%s) as it is already attached to zone. |
01071de5 | DOS Profile (%s) cannot be attached to the Zone as DNS is enabled on the profile. |
01071e02 | DOS profile (%s) not found. |
01071e03 | Maximum (%s) can be attached per Zone containing DOS profiles. |
01071e09 | DOS Profile (%s) cannot be attached to zone as threshold mode is not Fully Manual. |
01071e0d | Security log profiles '%s' and '%s' cannot be associated simultaneously with a Zone '%s', since they have same or mutually exclusive parts enabled. |
01071e0e | Security log profiles '%s' and '%s' cannot be associated simultaneously with a Zone '%s', since they both have local logging enabled. |
01071e0f | DOS profile (%s) cannot be attached to the Zone (%s) as the Zone has one or more VLANs that are part of other Zones and a VLAN cannot be a member of more than one Zone which have DDoS protections enabled. |
01073035 | The encryption key for OAuth profile (%s) cannot be modified directly. Use encryption secret to generate a new encryption key. |
01073039 | All the JWK configs in a JWT config must have unique cert-thumbprint-sha1. The cert-thumbprint-sha1 '%s' is already present in JWT config '%s'. |
01073040 | All the JWK configs in a JWT config must have unique cert-thumbprint-sha256. The cert-thumbprint-sha256 '%s' is already present in JWT config '%s'. |
010c0009 | Lost connection to mcpd - reestablishing |
010c0018 | Standby |
010c0022 | Opening %s for failover monitoring |
010c002a | Requesting tmm to resend gratuitous arps for traffic group %s. |
010c002b | Traffic group %s received a targeted failover command for %s. |
010c002c | Traffic group %s received a targeted failover command from cluster mate for %s. |
010c002d | Traffic group %s going standby via targeted failover command. |
010c0037 | Up service module error %s. |
010c003b | Bind fails on %s addr %s port %d error %s |
010c003c | Connect fails on %s addr %s port %d error %s |
010c003e | Offline |
010c003f | Forced offline |
010c0044 | Command: %s |
010c0048 | Bcm56xxd and lacpd connected - links up |
010c0049 | Tmm ready - links up. |
010c0050 | Sod requests links down |
010c0052 | Standby for traffic group %s |
010c0054 | Offline for traffic group %s. |
010c0055 | Forced offline for traffic group %s. |
010c0056 | Deactivating traffic group %s |
010c0057 | Activating traffic group %s |
010c005a | Dropping a failover packet that is too small (%u) |
010c005b | Dropping a packet that is not a failover packet. |
010c005e | Waiting for mcpd to reach phase base, current phase is %s |
010c005f | Mcpd has reached phase base, current phase is %s |
010c0063 | Waiting for Mcpd without a response. Try again... |
010c006a | Configuration CRC values disagree amongst peers. Suggest configsync peers. |
010c006b | Configuration CRC values agree amongst peers |
010c006c | proc stat: [0] %s |
010c006d | %s. |
010c006e | All devices in traffic group %s %s have a HA group. |
010c0076 | Exceeded mcp recv soft limit: %d. Succeeded after %d messages. |
010c0077 | Listening for unicast failover packets on address %s port %d. |
010c007b | Deleted unicast failover address %s port %d for device %s. |
010c007e | Not receiving status updates from peer device %s (Disconnected). |
010c0082 | Sorted Load-Aware failover %s. |
010c0083 | No failover status messages received for %s seconds, from device %s (%s). |
010c0084 | Failover status message received after %s second gap, from device %s (%s). |
010c0085 | First failover status message received from device %s (%s). |
010c0089 | Invalid go standby command. %s is not a valid traffic-group or device. |
010c008a | Invalid go standby command. %s is not a valid device. |
010c008b | Unable to send to unreachable unicast address %s port %d. |
010c008c | Previously unreachable unicast address %s port %d is now reachable. |
010c0098 | Multicast socket connect failure: %s. |
010c0099 | Connected to multicast group %s port %d on interface %s. |
010c009a | Disconnected from multicast group %s port %d on interface %s. |
010c009b | Availability log %s failed '%s'. |
010c009c | Timer interval set to %u.%06us (was %u.%06u). |
010c009d | Poll interval %dms, estimated %d packets/sec. |
010c009e | Config crc changed: old 0x%x new 0x%x. |
010d0005 | Chassis fan %d: status (%d) is bad |
010d0006 | Chassis power supply %d has experienced an issue. Status is as follows: %s |
010d0009 | %s: voltage (%d) is too high |
010d0010 | %s: fan speed (%d) is too low |
010d0017 | %s: milli-voltage (%d) is too low |
010e0001 | Cannot communicate with MCPD server |
010e0002 | Established new connection to MCPD server |
010e0004 | MCPD query response exceeding %d seconds |
01100002 | alertd is going down |
01100017 | Email action is failed for toaddress %s |
01100042 | Failed with MCPD at: %s (%s) |
01100043 | logcheck Notice: %s %d |
01100048 | "Log disk usage still higher than %d%% after logrotate and %d times log deletion" |
01100049 | logcheck Info: %s %d |
01100053 | %s |
01100054 | %s |
01100055 | %s |
01100056 | %s |
01100057 | %s |
01100058 | %s |
01100059 | Found db_name %s without value - reset to default %s. |
01100060 | trap string (%s) count (%d) (%s)"); |
01100061 | clear suppression map (count %d)"); |
01110001 | Error running %s |
01110034 | The configuration for running config-sync is incorrect. |
0114001a | HA stale %s pid %d detected. |
01140029 | HA %s %s fails action is %s. |
0114002a | HA %s %s created. |
0114002b | HA %s %s enabled. |
0114002c | HA %s %s disabled. |
01140030 | HA %s %s is now responding |
01140043 | Ha feature %s reboot requested |
01140044 | HA reports tmm ready |
01140045 | HA reports tmm NOT ready |
01140100 | Overdog daemon startup |
01140101 | Overdog daemon shutdown |
01140102 | Overdog daemon requests reboot |
01140103 | Watchdog touch enabled with %d seconds |
01140104 | Watchdog touch disabled |
01140106 | Overdog daemon calling bigstart restart |
01150216 | Notice from %s: %s |
01150515 | Processing Resource Record (%s:%s) failed due to error '%s'. |
01150a51 | %s/%s change detected %s. |
01150a52 | Sync Zones Parameters: Ciphers = %s, Use expired CRL = %s, Use Not Yet Active CRL = %s, Use Revoked Certificates = %s, Validation Depth = %s |
01150d03 | Attempting to %s loopback address %s |
01151500 | NamedWatcher: Error encountered during initialization of named configuration monitor: %s. |
01151501 | NamedWatcher: Watching cur stat for dir:%s ts:%ld inode:%llu with id:%d. |
01151502 | NamedWatcher: Error %s setting up watch for dir:%s. |
01151503 | NamedWatcher: Unexpected EOF %s from named configuration monitor file descriptor. |
01151504 | NamedWatcher: Error %s reading from named configuration monitor file descriptor. |
01151505 | NamedWatcher: Expected at least %d bytes, only %d bytes are available. |
01151506 | NamedWatcher: Kernel monitor overflow %s. |
01151507 | NamedWatcher: %s monitor wd:%d len:%d events:%s dir:'%s' name:'%s'. |
01151508 | NamedWatcher: Read ignored event. |
0115150a | NamedWatcher: %s stat for %s ts:%ld inode:%llu. |
0115150b | NamedWatcher: stat for '%s' failed:%s. |
0115150c | NamedWatcher: Skipping event %s (len:%d) for '%s' because it contains the %s. |
0115150d | NamedWatcher: Deleting watch for dir:%s with id:%d. |
0115150f | NamedWatcher: Watch added for dir %s with ts:%ld with id:%d |
01151510 | NamedWatcher: Watch added for file:%s in dir:%s with ts:%ld, inode:%llu. |
01151511 | NamedWatcher: Watch removed for file %s in dir %s. |
01151512 | NamedWatcher: Watch removed for dir %s. |
01151513 | NamedWatcher: Read event for dir:'%s'. |
01151513 | NamedWatcher: Watch already exists for dir %s. |
01151514 | NamedWatcher: Watch already exists for file:%s in dir:%s. |
01151515 | NamedWatcher: Dont care about event wd:%d events:%s name:'%s'. |
01151515 | NamedWatcher: Error %s setting up watch for dir:%s. |
01151516 | NamedWatcher: No matching watch for dir:%s with id:%d. |
01151517 | NamedWatcher: No matching event type:%s for file:%s in dir:%s with id:%d. |
01151518 | NamedWatcher: event->len == %d. |
01151519 | NamedWatcher: Initializing... |
01160004 | LACPD reporting error conditions |
01160005 | LACPD reporting internal error conditions |
01160009 | LACPD reporting a link being added to aggregation |
01160010 | LACPD reporting a link being removed from aggregation |
01160011 | LACPD reporting a churn condition |
01160012 | LACPD reporting a churn condition |
01160016 | LACP reporting an internal condition as informational message |
01160017 | Internal Link %s is AVAILABLE. |
01160018 | Internal Link %s is UNAVAILABLE. |
01160024 | %s |
01170003 | halGetDossier returned error (%d): Dossier generation failed. |
01170005 | %s stat fails: %s. |
01170012 | Unsupported argument (-%c). |
01170019 | Detected Registration Key-Less dossier generation for CSP. |
01170020 | Option -%c requires an argument. |
01170021 | Invalid value (%s) passed for option (-%c). |
01180005 | Evaluation license has expired. |
01180010 | [license processing][error]: %s |
01180017 | Subscription license has expired. |
01190003 | arp_input: packet too short (%lu/%lu) |
01190004 | address conflict detected for %a (%m) on vlan %d |
01190007 | Neighbor update, route lookup failed, address = %la%%%u |
01190008 | Neighbor update, route is not link type, address = %la%%%u |
01190009 | Neighbor update failed, err = %E, address = %la%%%u, ifc name = %s |
01190010 | Neighbor delete failed, err = %E, address = %la%%%u |
011a0011 | SYNC Possible conflicting config changes between %s (%s) and %s (me), both at timestamp %llu. Config changes ignored. |
011a0060 | Compression Stream failure: %s |
011a0061 | License is not operational |
011a0300 | There was an error trying to send a DNSSEC Key Generation %s msg to MCP |
011a0300 | There was an error trying to send a DNSSEC Key Generation %s msg to MCP |
011a0302 | %s : %llu. |
011a0302 | There was an error trying to send a DNSSEC Zone SOA serial modify msg to MCP |
011a0305 | DNSSEC Zone %s cannot process a partial SOA serial update message |
011a0306 | Encountered error %s while trying to set a DNSSEC Key Generation event timer |
011a0307 | Processing %s Event for DNSSEC Key %s, ID %llu |
011a0308 | Unable to determine GTM local id, must skip processing DNSSEC Key Generation events |
011a0309 | DNSSEC DEBUG: %s. |
011a0309 | Failed to create new DNSSEC Key Generation %s:%llu due to %s. |
011a030a | Failed to import DNSSEC Key Generation %s:%llu due to %s. |
011a030b | Failed to delete DNSSEC Key Generation with handle: %s due to %s. |
011a030c | Postponing expiration of DNSSEC Key Generation %s:%llu as the next generation not created yet. |
011a030d | Canceling expiration of the latest DNSSEC Key Generation %s:%llu, resetting events of the Key. |
011a030e | Action execution of DNSSEC Key Generation %s:%llu takes too long, canceling the action. |
011a030f | Action of DNSSEC Key Generation %s:%llu failed or canceled, re-runing the action. |
011a0310 | Action of DNSSEC Key Generation %s:%llu failed or canceled, all attempts are exhausted. |
011a0311 | Failed to join worker-thread of DNSSEC Key Generation. |
011a0312 | Failed to initiate session with FIPS card. |
011a0313 | Key size %u is not suported by FIPS card. |
011a0314 | FIPS card failed to generate RSA pair for DNSSEC Key Generation. |
011a0315 | FIPS card failed to delete private part of DNSSEC Key Generation. |
011a0316 | FIPS card failed to import private part of DNSSEC Key Generation. |
011a0317 | Failed to %s PEM file %s for FIPS card. |
011a0318 | Failed to rename file %s to %s for FIPS card. |
011a0319 | Failed to initiate session with Thales. |
011a031a | Key size %u is not suported by Thales. |
011a031b | Thales failed to generate RSA pair for DNSSEC Key Generation. |
011a031c | Failed to get %s key from Thales after RSA pair generation. |
011a031d | Thales failed to delete private part of DNSSEC Key Generation: %s. |
011a031e | Failed to re-encrypt DNSSEC Key Generation %s:%llu. |
011a031f | DNSSEC Key Generation %s:%llu created: %s and %s. |
011a0320 | DNSSEC Key Generation %s:%llu imported to local FIPS card under identifier: %s. |
011a0321 | DNSSEC Key Generation %s:%llu removed: expired or removed from config. |
011a0322 | DNSSEC Key Generation %s:%llu expired. |
011a500f | %s (%s) identified as self, %s |
011a5010 | Unable to identify which gtm server represents the local device |
011a6006 | SNMP_TRAP: VS %s (ip:port=%s) (Server %s) state change %s --> %s (%s) |
011ad103 | BoxIP was NULL |
011ae045 | XML Buffer size (%lu bytes) exceeded when attempting to send %s. |
011ae050 | SSL Context set to use cipher list '%s'\n |
011ae051 | SSL Context set to use minimum TLS version '%s'\n |
011ae052 | Using Server specific(%s) cipher list '%s'\n |
011ae053 | Using Server specific(%s) minimum TLS version '%s'\n |
011ae054 | New key or certificate file detected, attempting to create new SSL Context. |
011ae055 | Creating replacement iQuery connection on all servers. |
011ae056 | Creating replacement iQuery connection to server %s. |
011ae057 | Creating replacement iQuery connection to ip %s. |
011ae058 | iQuery connection ID:%d to Remote IP:%s replaced with connection ID:%d. |
011ae059 | The specified TLS version (%s) is not a valid selection, SSL CTX not changed. |
011ae05a | The specified TLS version (%s) is not a valid selection. |
011ae05a | The specified TLS version (%s) is not a valid selection, server (%s) value not changed. |
011ae05b | SSL Cipher List unchanged since requested value is identical to current value %s". |
011ae05c | SSL Minimum TLS Version unchanged since requested value is identical to current value %s". |
011ae05d | Replacement iQuery connection to %s already in progresss. Ignoring request. |
011ae05e | iQuery connection ID:%d to Remote IP:%s created. |
011ae05f | SSL Context created with cipher list '%s' and minimum TLS version '%s'. |
011ae060 | Attempt(ignored) to replace an existing iquery connection with an invalid replacement. |
011ae106 | The monitor probing frequency has been adjusted because more than %d synchronous monitors were detected. |
011ae10e | Autoconf deleted link (%s) |
011ae10f | Autoconf deleted linkIP (%s) |
011ae110 | Autoconf skipped deletion of link (%s) because %s |
011ae111 | Autoconf skipped deletion of linkIP (%s) because member (%s) exists on box (%s) |
011ae112 | SSL Cipher List must not be empty. Previous setting remains in effect. |
011ae113 | SSL verification of SSL connection to: %s %s |
011ae114 | %s: SSL error: %s (%d) from connection %s |
011ae115 | SSL Minimum TLS Version must not be empty. Previous setting remains in effect. |
011ae116 | Topology detected bad order value (%u) for topology entry (%s), reset order to (%u) |
011ae116 | The list processing time (%d seconds) exceeded the interval value. There may be too many monitor instances configured with a %d second interval. |
011ae117 | Unable to process DB Variable (%s) |
011ae118 | Master Key encryption failed: %s. |
011ae119 | Master Key decryption failed: %s. |
011ae11a | Master Key updated, re-encrypting private texts of DNSSEC Key Generations. |
011ae200 | CRL file %s created, enabling CRL validation on all remote iQuery connections. |
011ae201 | CRL file %s removed, disabling CRL validation on all remote iQuery connections. |
011ae203 | CRL file %s contains no CRLs, or an invalid CRL. Remote iQuery connections may be rejected. |
011ae206 | CRL from issuer %s will expire on %s. |
011ae207 | Using expired CRL form issuer %s. |
011ae209 | Using not yet active CRL from issuer %s. |
011ae20a | CRL not found for certificate with subject %s from issuer %s. |
011ae20b | Certificate with subject %s from issuer %s is revoked. |
011ae20c | Certificate with subject %s from issuer %s will not be rejected due to revocation status. |
011ae20d | Error in %s: Cannot get current time. |
011ae20e | Will reverify all SSL connections in %ld seconds. |
011ae20f | Certificate validation failure. The iQuery connection to %s has been closed. |
011ae210 | Unable to verify the iQuery connection to %s: Cannot verify the peer certificate. |
011ae211 | %s: Error converting time |
011b0203 | Error '%s' opening file %s |
011b020b | Error '%s' scanning buffer '%s' from file '%s' |
011b0233 | CACHE MISS during %s, prev=%s, curr=%s. |
011b0236 | Merged iStats merge interval changed to be every %d seconds. |
011b0237 | Merged iStats merge interval called with %d. |
011b0309 | %s %s %s |
011b032e | Graph '%s' is not supported, possibly because it is not licensed, or a license has expired. |
011b0600 | Error '%s' during rrd_update for rrd file '%s' |
011b0601 | Error '%s' during rrd_graph for graph '%s' |
011b0816 | Statistic collection has ALREADY been started. |
011b0826 | Cluster collection start error.Exitting |
011b0900 | TMSTAT error %s: %s |
011b090c | tmstat_query_rollup on table %s called |
011b090e | getTMValueUNKeyed start |
011b090f | DNS Services request rate limiter engaged. |
011b0910 | DNS Services request rate limiter disengaged. |
011b0914 | No individual CPU information is available. |
011b0999 | %s: %s |
011b1100 | FIPS Device: Temperature approaching maximum range (%dC). |
011b1101 | FIPS Device: Temperature met or exceeded critical range (%dC). |
011b1102 | FIPS Device: Temperature returned to normal range (%dC). |
011b1103 | FIPS Device: Resetting statistics to synchronize counts. |
011b1104 | FIPS Device: Unable to read or recreate FIPS data file for statistics history. |
011b1105 | FIPS Device: Deleting FIPS statistics TMSTAT segment. |
011b1106 | FIPS Device: Could not initialize statistics, timer not started. |
011d0002 | No diskmonitor entries in database |
011d0004 | Disk partition %s has only %d free |
011e0001 | Limiting %s from %d to %d packets/sec for traffic-group %s |
011e0002 | %s: Aggressive mode %s %s (%llx) (%s %s). (%llu/%llu %s) |
011e0003 | mode sweeper: %s (%llx) (%s %s) %d Connections killed |
011f0001 | %s: Bad chunk state %d |
011f0004 | Invalid header insert profile, missing the colon separator in - %s |
011f0005 | HTTP header (%d) exceeded maximum allowed size of %d |
011f0007 | %s - Invalid action:0x%x %s (%C) %s (%C) |
011f0008 | %s - Invalid state transition to %s |
011f0011 | HTTP header count exceeded maximum allowed count of %d |
011f0012 | HTTP profile option %s incompatible with proxy_type. Using default instead. |
011f0016 | %s - Invalid action:0x%x Server sends too much data. serverside (%C) clientside (%C) |
011f0017 | Config error: HTTP Header Entry [%s:%d] update: agent clone failed |
01200009 | Packet rejected remote IP %*A port %d local IP %*A port %d proto %s: Connection limit exceeded. |
01200012 | Warning, connections equals limit %F, proto %s, VS %s: Connection limit reached. |
01200014 | Warning, connections equals limit %F, proto %s, RD %s: Connection limit reached. |
01200016 | Warning, node IP %*A has reached its connection limit. |
01200017 | Warning, pool member IP %*A port %u for pool %s has reached its connection limit. |
01220001 | TCL error: %s |
01220002 | Rule %s: %s |
01220007 | No pending rule event found for %F |
01220008 | Unable to resume pending rule event %s for closed %F |
01220009 | Pending rule %s aborted for %F |
01220010 | %d previous aborted rule log messages suppressed |
01220011 | Pending rule %s aborted for context %llx |
01220012 | Failed to configure rule %s for virtual %s. |
01230001 | Interface %d.%d: link is up, %dMbps %s |
01230002 | Interface %d.%d: link is down |
01230032 | Interface %s not found |
01230066 | Vlan %s - untagged interface %d/%d currently in use on vlan %s |
01230074 | Vlan %s, member %s - unsupported type %d |
01230087 | Vlan %s, member %s instance add error %u |
01230088 | Couldn't %s vlangroup %s |
01230111 | Interface %d.%d: HSB DMA lockup on %s. |
01230113 | "Unsupported media setting %s for interface %s" |
01230140 | RST sent from %A:%d to %A:%d, %s |
01240006 | Error querying request URI: %s |
01260000 | Profile %s: %s |
01260006 | Peer cert verify error: %s (depth %d; cert %s) |
01260008 | SSL transaction (TPS) rate limit reached |
01260009 | Connection error: %s:%d: %s (%d) |
01260010 | FIPS acceleration device failure: %s |
01260012 | Self-initiated renegotiation attempted while renegotiation disabled: %s |
01260013 | SSL Handshake failed for <PROTOCOL> <SRC> -> <DST> |
01260014 | Cipher %x:%x negotiated is not configured in profile %s |
01260014 | Cipher %x:%x negotiated is not configured in profile %s |
01260015 | Certificate supplied by server (subject CN: %s) was not configured on virtual: %s |
01260017 | Connection attempt to insecure SSL server (see RFC5746) aborted: %A:%d |
01260018 | Connection attempt to insecure SSL server (see RFC5746): %A:%d |
01260024 | OCSP failure on profile %s, certificate with issuer %s and serial number %lx: %s - %s |
01260025 | Cipher %x:%x negotiated is not supported by Proxy SSL configured in virtual server %s |
01260026 | No shared ciphers between SSL peers %A.%d:%A.%d. |
01260034 | SSL decryption canceled. |
01260045 | Certificate with subject name (%s) and serial number (%s) is revoked |
0127000c | Coalesced (%lu) requests for the previous command into 1 execution |
01280045 | Debug: %s |
01290003 | HALMSG reporting error conditions |
01290004 | HALMSG reporting warning conditions |
012a0000 | "LIBHAL reporting system is unusable" |
012a0002 | "LIBHAL reporting critical conditions" |
012a0003 | LIBHAL reporting error conditions |
012a0004 | LIBHAL reporting warning conditions |
012a0005 | LIBHAL reporting normal but significant condition |
012a0006 | LIBHAL reporting informational |
012a0007 | LIBHAL reporting debug-level messages |
012a0012 | Blade %d is about to be powered off! |
012a0013 | Blade %d hardware sensor critical alarm: %s |
012a0016 | Blade %d hardware sensor notice: %s |
012a0017 | Chassis power module %d turned on |
012a0019 | Chassis power module %d is on. |
012a0021 | Chassis power module %d absent. |
012a0022 | %s |
012a0023 | %s |
012a0024 | %s |
012a0025 | %s |
012a0026 | %s |
012a0027 | %s |
012a0028 | %s |
012a0029 | %s |
012a0030 | %s |
012a0031 | %s |
012a0032 | %s |
012a0033 | %s |
012a0034 | %s |
012a0035 | %s |
012a0036 | %s |
012a0037 | %s |
012a0038 | %s |
012a0039 | %s |
012a0040 | %s |
012a0041 | %s |
012a0042 | %s |
012a0043 | %s |
012a0044 | %s |
012a0045 | %s |
012a0046 | Chassis power module 1 turned on. |
012a0047 | Chassis power module 2 turned on. |
012a0048 | Chassis power module 3 turned on. |
012a0049 | Chassis power module 4 turned on. |
012a0050 | Chassis power module 1 turned off. |
012a0051 | Chassis power module 2 turned off. |
012a0052 | Chassis power module 3 turned off. |
012a0053 | Chassis power module 4 turned off. |
012a0054 | Chassis power module 1 absent. |
012a0055 | Chassis power module 2 absent. |
012a0056 | Chassis power module 3 absent. |
012a0057 | Chassis power module 4 absent. |
012a0058 | Chassis with %d blades (%d W) may be inadequately powered - increase active number of power supplies |
012a0059 | Chassis power module %d is unidentified. |
012a0060 | Power supplies do not match. |
012b0021 | Executable %s version '%s'. |
012b0022 | Executable %s version is newer than %s. |
012b0023 | Executable %s SELinux context error (%s). |
012b101e | Dropping a message received from an unknown connection type from %s. |
012b101f | Deleted connection %s. |
012b2007 | %s: Begin xml broadcast |
012b2008 | %s: End xml broadcast |
012b2009 | Skipped xml broadcast to: %s reason: %s |
012b200a | Failed to send xml message: %s |
012b3005 | Error encountered while opening SSL certificates %s. |
012b3007 | SSL Context created using minimum TLS version %s, SSL cipher list '%s'. |
012b3008 | SSL Context Cipher list set to: %s. |
012b3009 | SSL Context minimum TLS Version set to: %s. |
012b300a | SSL Cipher list converted from:'%s' to:'%s' |
012b300a | SSL Context Cipher list converted from:'%s' to:'%s' |
012b300b | Replacing iQuery connection (%s:%d) with connection (%s:%d) |
012b300c | iQuery connection with id %d not found. |
012b300d | Error setting SSL Cipher list to: %s, previous value (%s) remains in effect. |
012b300e | SSL Error: %s on connection to %s. |
012b300f | Error setting SSL Context options. |
012b3010 | The specified TLS version (%s) is not a valid selection, SSL CTX not changed. |
012b3011 | Found an unexpected connection of type %d when looking for a GTM connection. |
012b3014 | Routine renegotiation of SSL connection with %s completed. |
012b3100 | CRL file %s created, enabling CRL validation on all remote iQuery connections. |
012b3101 | CRL file %s removed, disabling CRL validation on all remote iQuery connections. |
012b3102 | CRL file %s was updated, replacing iQuery CRLs. |
012b3103 | CRL file %s contains no CRLs, or an invalid CRL. Remote iQuery connections may be rejected. |
012b3104 | Unable to allocate memory for crl: %s. |
012b3104 | %s: out of memory. |
012b3105 | CRL from issuer %s has expired. |
012b3106 | CRL from issuer %s will expire on %s. |
012b3107 | Using expired CRL from issuer %s. |
012b3108 | CRL from issuer %s is not yet active, will become active %s. |
012b3109 | Using not yet active CRL from issuer %s. |
012b310a | CRL not found for certificate with subject %s from issuer %s. |
012b310b | Certificate with subject %s from issuer %s is revoked. |
012b310c | Certificate with subject %s from issuer %s will not be rejected due to revocation status. |
012b310d | Error in %s: Unable to get current time. |
012b310e | Will reverify all SSL connections in %ld seconds. |
012b310f | Unable to reverify the iQuery connection to %s: Cannot verify the peer certificate. |
012b3110 | Certificate validation failure. The iQuery connection to %s has been closed. |
012b3111 | %s: Error converting time |
012b400b | Moved %d pending and %d active probers from connection %u to connection %u |
012b7010 | No Route Domain support, cannot create a listener for Route Domain %u. |
012c0004 | Lost connection with MCP: %d ... Exiting |
012c0010 | BCM56XXD driver error |
012c0011 | BCM56XXD SDK error |
012c0012 | BCM56XXD info |
012c0013 | BCM56XXD starting |
012c0014 | SAMPLE: bcm56xxd - Exiting... |
012c0015 | Link: %s is %s |
012c0016 | BCM56XXD SDK info |
012c0023 | Optic in wrong port |
012c0024 | Optic Warning |
012c0025 | F5 Optics not supported on platform |
012d0007 | Lost connection with MCP: %08x |
012e0029 | The configuration was successfully loaded. |
01300001 | RAMCACHE Initialize - Not enough memory available to create the cache. Please try reducing the cache size and max entries |
01300002 | RAMCACHE Response - Too many Cache-Control headers in response, max is %d. |
01300003 | RAMCACHE - Header too long. Header %d of length %d exceeds the max %lu bytes. |
01310027 | ASM subsystem error (%s,%s): %s |
01330024 | Regular expression compilation failed on recv string: %s |
01330025 | Unable to get a session to cache for %s:%d |
01340001 | HA Connection with peer %la:%d for traffic-group %s established. |
01340002 | HA Connection with peer %la:%d for traffic-group %s lost |
01340003 | Cluster error: %s |
01340004 | HA Connection detected dissimilar peer: local npgs %u, remote npgs %u, local npus %u, remote npus %u, local pg %u, remote pg %u, local pu %u, remote pu %u. Connection will be aborted. |
01340007 | HA Connection with peer %la:%d for traffic-group %s closing. |
01340009 | HA reconnect with peer %la:%d for traffic-group %s postponed. |
01340012 | HA context missing for %s on virtual %s |
01360008 | ERROR: Cannot connect to GWM server %s; Will try it again in 30 seconds. |
01380002 | Certificate '%s' in file %s will expire on %s |
013a0004 | %s |
013a0005 | %s |
013a0006 | %s |
013a0007 | %s |
013a0008 | %s |
013a0014 | %s |
013a0015 | %s |
013a0016 | %s |
013a0018 | "%s" |
013a0019 | %s |
013a0020 | %s |
013a0024 | %s |
013b0004 | %s |
013b0008 | %s |
013c0004 | %s |
013c0006 | %s |
013d0006 | cand done |
013e0000 | Tcpdump starting locally on %la:%u from %la:%u |
013e0001 | Tcpdump starting bcast on %la:%u from %la:%u |
013e0002 | Tcpdump stopping on %la:%u from %la:%u |
013e0005 | Tcpdump starting remote to %A from %A |
013e0006 | Tcpdump to %A failed to connect : %E |
013e0007 | Tcpdump stopping remote to %A from %A |
013e0008 | Tcpdump ICMP error Type:%d Code:%d from %A |
013e0009 | Tcpdump DPT session end error provider:%s id:%d err:%d |
013e000d | AUDIT - %s |
01410000 | %s |
01410004 | RTSP: client_port and server_port not paired |
01410005 | RTSP: client_port and server_port not specified |
01410006 | RTSP: multicast not compatible with unicast or interleaved |
01410007 | RTSP: incompatible port specifications |
01410008 | RTSP: no multicast port(s) specified |
01410009 | RTSP: no multicast address specified |
0141000a | RTSP: Expiring active RTP peer connection |
0141000b | RTSP: Expiring active RTCP peer connection |
0141000c | RTSP: Expiring active RTP connection |
0141000d | RTSP: Expiring active RTCP connection |
0141000e | RTSP: release RTP peer conn flow |
0141000f | RTSP: release RTCP peer conn flow |
01410010 | RTSP: release RTP conn flow |
01410011 | RTSP: release RTCP conn flow |
01410012 | RTSP: Can't create RTP endpoints: %E |
01410013 | RTSP: Can't create RTCP endpoints: %E |
01410014 | RTSP: Failed to set up sa_entry on client |
01410015 | RTSP: Can't find a port for media connections |
01420001 | %s |
01420002 | SAMPLE: tmsh - AUDIT - pid=13324 user=root query_partitions=all update_partition=Common module=(tmos)# status=[Command OK] cmd_data=list ltm virtual idnshare3-139 |
01420003 | "%s" |
01420004 | %s |
01420006 | %s |
01420007 | Certificate '%s' in file %s expired on %s |
01420008 | Certificate '%s' in file %s will expire on %s |
01420010 | %s |
01460005 | SAMPLE: promptstatusd - mcpd.running(1) held, wait for mcpd |
01460006 | SAMPLE: promptstatusd - semaphore tmm.running(1) held |
01460007 | SAMPLE: promptstatusd - semaphore tmm.running(1) released |
01470000 | iSession: Connection error: %s:%u: %s:%d |
01470002 | iSession: tunnel %F: connection error: deduplication: unrecognized control message %d |
01470006 | iSession: tunnel %F: internal error: %s:%d: %s: %E; connection aborted |
01470007 | iSession: internal error: %s:%d: %s: %E |
01480001 | %s |
01480002 | %s |
01480010 | Got a message(%d) for a non existent flow |
01480024 | Can't bind the flow, waiting for config response on channel %s |
01480031 | headers limited to %d bytes |
01480052 | Profile %s missing plugin_type field. |
01480053 | Profile %s missing tmi_type field. |
01480054 | Command %s not registered. |
01490510 | %s: Initializing Access with max global concurrent access session limit: %d |
01490523 | {{Access Profile, %s}{Partition, %s}{Session ID, %s}{Max Concurrent Sessions, %d}} "#0:#1:#2: Initializing Access with max global concurrent connectivity session limit: #3" |
01490526 | %s: Initializing Access with max global concurrent connectivity session limit: %d |
01490541 | Access using device name: %s and device ID: %.*s. |
01490555 | %s: Initializing Access with max global concurrent url filtering session limit: %d |
01490570 | PPP listener local address %A tunnel nexthop is NULL |
01490572 | %s: API Protection feature is %s |
01490573 | %s: Ephemeral Authentication feature is %s. |
014b0002 | RADIUS: %s error %lE |
014c0001 | DIAMETER: %s error: %lE |
014c000f | DIAMETER: Invalid AVP length: %d |
014c0010 | DIAMETER: Invalid AVP code |
014c0010 | DIAMETER: Invalid AVP length: %d |
014c0011 | DIAMETER: Invalid AVP code |
014c0012 | DIAMETER: Invalid event |
014c0013 | DIAMETER: Retransmission triggered by timeout for message: AppId %lu HopByHopId %lu from %s |
014c0014 | DIAMETER: Retransmission triggered by result code %d for message: AppId %lu HopByHopId %lu from %s |
014c0015 | DIAMETER: Retransmission triggered by iRule (note '%s') for message: AppId %lu HopByHopId %lu from %s |
014c0016 | DIAMETER: Retransmission generated an error answer of %d for message: AppId %lu HopByHopId %lu EndToEndId %lu from %s |
014c0017 | DIAMETER: Retransmission retransmitted request message: AppId %lu HopByHopId %lu from %s |
014c0018 | DIAMETER: Message dropped after routing error %s: AppId %lu HopByHopId %lu EndToEndId %lu from %s |
014c0019 | DIAMETER: Error answer of %d generated after routing error %s: AppId %lu HopByHopId %lu EndToEndId %lu from %s |
014c001a | DIAMETER: Message added to Retransmission queue: AppId %lu HopByHopId %lu from %s |
014c001b | DIAMETER: Message removed from Retransmission queue: AppId %lu HopByHopId %lu EndToEndId %lu from %s |
014c001c | DIAMETER: Deleting stale pending request entry: original HopByHopId %lu outgoing HopByHopId %lu persistence key %s expected from %A |
014c001d | DIAMETER: Unexpected answer message arrived: HopByHopId %lu from %A |
014c001e | DIAMETER: Dropping late answer for original request after request retransmitted: HopByHopId %lu from %A |
014c001f | DIAMETER: %s transport window for retransmission queue %c or proxy queue %c |
014c0020 | DIAMETER: Looped message detected from peer %s |
014c0022 | DIAMETER: Forced down pool member %A:%u as BIG-IP received DPR from it |
014c0023 | DIAMETER: Disabled pool member %A:%u as BIG-IP received DPR from it |
014e0001 | mysql failure detected, attempting to restart mysql (attempt %d). |
014e0003 | mysql service back online. |
014e0007 | mysqlhad starting to monitor mysqld |
014f0001 | %s |
014f0002 | %s |
014f0004 | %s |
014f000e | Becoming primary cluster member |
014f0013 | Script (%s) generated this Tcl error: (%s) |
014f0017 | Perpetual handler (%s) exited with failure |
01510003 | %s |
01510004 | %s |
01510005 | SAMPLE: vcmpd - VDisk (LBEMP-LOTWAN01.img/1): Failed to save info file - /shared/vmdisks/LBEMP-LOTWAN01.info |
01510007 | %s |
01510011 | vCMP guest %s powered off. |
01530007 | %s started =============================== |
0153000c | Error writing scratch database(%s), serving database is unchanged. zxfrd will exit and restart. |
0153002c | An instance of zxfrd (pid: %d) is already running! Exiting |
01531003 | Failed to sign zone transfer query for zone %s using TSIG key %s |
0153100c | Failed on receive of %d bytes for transfer of zone %s (%s) |
0153100e | Transfer of zone %s failed with rcode (%s). |
01531010 | Transfer of zone %s failed b/c there are no records |
01531015 | Failed to retrieve next RR in %s for zone %s |
01531018 | Failed to transfer zone %s from %s, will attempt %s |
0153101b | Ignoring NOTIFY for zone %s due IXFR in progress |
0153101c | Handling NOTIFY for zone %s |
0153101f | %s Transfer of zone %s from %s succeeded |
01531023 | Scheduling zone transfer in %ds for %s from %s |
01531025 | Serials equal (%d); transfer for zone %s complete |
0153102a | Failed connect callback to %s for transfer of zone %s |
0153102d | Notify request from %s not in allow-notify-list. Ignoring. |
0153102e | Error %s during socket %s. |
0153102f | Timed out waiting for transfer data for zone %s. |
01531030 | Kicking read timer for zone %s. |
01531031 | Setting read timer for zone %s. |
01531032 | There is an existing zone transfer scheduled for zone %s from %s, not re-scheduling. |
01531033 | There is a backlogged zone transfer scheduled for zone %s from %s, not adding another. |
01531105 | Zone %s expired. Zone will be unavailable until the next successful zone transfer. |
0153120c | Zone %s saved to scratch DB with SOA Serial %d. |
01531300 | Cluster status changing from %s to %s |
0153e0f7 | Lost connection to mcpd |
01550004 | Critical: |
01550005 | Critical: |
01550006 | Critical: |
01570004 | %s |
015a0000 | SAMPLE: devmgmtd - Initial trust configuration created |
015a0004 | "%s" |
015c0004 | %s |
015c0009 | IP Reputation has no license currently |
015c0010 | Initial load of IP Reputation database has been completed |
015e0002 | [pg:%d pu:%d] %s: %s |
015e0004 | [pg:%d pu:%d] %s: %s |
015f0028 | |
015f0029 | |
015f0029 | date_time, management_ip_address, bigip_hostname, device_product, device_vendor, device_version, msg_name, nps_name, bits_per_second, packets_per_second, connections_per_second, total_bits_per_po, total_packets_per_po, total_connections_per_po |
015f0030 | |
015f0031 | |
015f0032 | |
015f0033 | |
01630002 | (%s) (%s) |
01660009 | %s |
01660010 | %s |
01660011 | %s |
01660012 | %s |
01660013 | %s |
01660014 | %s |
01660015 | Interface %s. Non-F5 branded optics are not supported |
01660016 | %s |
01670003 | Inbound entry %A,%d,%A,%A found |
01670006 | [%u.%u] DNAT Picked :%A,%d |
01670009 | Inbound connection :%A,%d is active |
01670010 | Inbound entry:%A%%%d:%d, ds-lite remote:%A local:%A timeout:%d for key:%A%%%d:%d proto:%d added. ha mirrored: %s |
01670016 | No inbound entry found for %A%%%u:%u proto:%u |
01670019 | "DNAT configuration: %s" |
01670020 | DNAT connection: %s |
01670021 | [%u.%u] LSN Pool %s has no usable translation address for DNAT |
01670028 | LSN pool(%s) inbound route domain id %d\n |
01670029 | Translation failed: %s is unsupported.\n |
01680027 | netHSM: Thales RFS error [%s]. |
01680028 | netHSM: Cannot load HSM vendor library [%s] with error [%s]. |
01680029 | netHSM: Failed login: password[%s]. Error[%lu]. |
01680030 | netHSM: Failed to allocate space [%lu] for [%s]. |
01680031 | netHSM: The session with the network-hsm is invalid. |
01680032 | netHSM: PKCS11d stopped. Verify password, and restart PKCS11d. |
01680033 | netHSM: BigDB error [%d][%s]. |
01680034 | netHSM: Key name is too long (>=255). |
01680035 | netHSM: PKCS11d (re)initialization is not complete. |
01680036 | netHSM: Unknown HSM vendor [%s]. |
01680037 | netHSM: Failed to create ec key for key %llu |
01680038 | netHSM: Failed to set ec group for key %llu |
01680039 | netHSM: Failed to create ec point for key %llu |
01680040 | netHSM: Failed to find partition with label '%s' on the netHSM. |
01680041 | Failed to add key to cache index %lu; err %d. Cache size %lu. |
01680042 | Failed to find key handle for %s key with %s '%s'. |
01680043 | Failed to find key attribute [%s] for key with handle [%llu] . |
01680044 | Thread [%lu] successfully connected to partition labeled '%.*s' in slot '%lu'. |
01680045 | Nethsm: number of slots %u |
01680046 | pkcs11d loading key handles. |
01680047 | pkcs11d invalidating key handles. |
01680048 | %s: pkcs11_rv=0x%08lx, %-26s. |
01680049 | [PKCS11D][%u]:%s:%d: %s |
01680050 | %s |
01680051 | %s. |
01680052 | %s. |
01690000 | SAMPLE: evrouted - shutdown cleanly |
016b0002 | Rewrite: %s |
016e0002 | Execution of action '%.*s' failed, error %E |
016e0005 | Unable to resume pending policy event on connflow %F |
016e0006 | Pending policy event missmatch found for %F |
01700000 | PPTP CALL-REQUEST id;%d from;%A%%%u to;%A nat;%A%%%u ext-id;%d |
01700001 | PPTP CALL-START id;%d from;%A%%%u to;%A nat;%A%%%u ext-id;%d |
01700002 | PPTP CALL-END id;%d reason;%d from;%A%%%u to;%A nat;%A%%%u ext-id;%d |
01700005 | Error creating PPTP-GRE local flows, error %E. |
01700009 | Unable to locate flow %F. |
0170000a | Received an unexpected PPTP Control Message(%s) while processing connflow %F. Reason: %s. |
0170000b | Connflow(%F) has no peer, ignoring. |
01700020 | Unable to locate PPTP GRE flow with %s key %d while processing connflow %F. |
01700021 | Unable to retrieve layer 3 header from packet while processing connflow %F. |
01700023 | Connflow (%F) ignoring an unexpected MPI remote flow response. |
01700028 | Unable to find serverside PPTP flow for clientside flow %F. |
01700029 | PPTP DSLITE-CALL-REQUEST id;%d from;%A%%%u,%A%%%u to;%A nat;%A%%%u ext-id;%d |
01700030 | PPTP DSLITE-CALL-START id;%d from;%A%%%u,%A%%%u to;%A nat;%A%%%u ext-id;%d |
01700031 | PPTP DSLITE-CALL-END id;%d reason;%d from;%A%%%u,%A%%%u to;%A nat;%A%%%u ext-id;%d |
01700032 | PPTP DSLITE-CALL-FAILED id;%d reason;%d from;%A%%%u,%A%%%u to;%A nat;%A%%%u ext-id;%d |
01740018 | Profile PCP error: Invalid operation for %s. |
01740023 | Profile PCP error: PCP %s missing from message. |
01740036 | PCP: Invalid %s Option length, Expected %lu, Found %d - Client %A rtid %d |
01740039 | PCP Request: Client %A - OpCode %s(%d), Lifetime:%u, Packet Length:%lu |
017b0009 | IVS (connecting from parent %F): Internal virtual server %s received injected message %s with data %#x |
017c0003 | tmm IPsec: Tunnel down %A - %A |
017c0004 | tmm IPsec: Tunnel up %A - %A |
017c0005 | listener binding ERR=%d %s listener %s %A:%d FAIL |
017c0006 | NOTE: avoid common IPsec v1 and v2 tunnel local addr |
017c0007 | IPsec Tunnel UP destination(%A) source(%A) reqid(%d) |
017c0008 | IPsec Tunnel DOWN destination(%A) source(%A) reqid(%d) |
017e0004 | GTP: Failed to parse message err (%E) flow (%C) |
017e0005 | GTP: Failed to parse header extension err (%E) |
017e0006 | GTP: Failed to parse element err (%E) |
017e0007 | GTP: Failed to parse group element err (%E) internal parent id (%u) |
017e0008 | GTP: Failed to allocate message err (%E) |
017e0009 | GTP: Failed to pullup (%d) bytes err (%E) |
017e0010 | GTP: Failed to move (%d) bytes err (%E) |
017e0011 | GTP: Failed in header cache err (%E) type (%u) len (%u) |
017e0012 | GTP: End of header contains invalid byte (%u) |
017e0013 | GTP: Version (%u) is invalid |
017e0014 | GTP: Element type (%u) is invalid or not supported |
017e0015 | GTP: Message len (%u) does not match buffer len (%u) |
017e0016 | GTP: Element to be parsed len (%u) does not match buffer len (%u) |
017e0017 | GTP: Payload offset (%u) + len (%u) does not match buffer len (%u) |
017e0018 | GTP: Message received (%u) is too short, expect %lu |
017e0019 | GTP: Header length (%u) is too short, expect %lu |
017e0020 | GTP: Number of elements (%lu) is beyond the limit (%lu) |
017e0021 | GTP: Number of BCD digits (%d) is higher than limit (%lu) |
01810004 | %s |
01810007 | "%s" |
01810008 | %s |
01820004 | %s |
01830003 | Unable to find a flow for remote vtep %A%%%u, tunnel name = %s. |
01830004 | Tunnel output has a potential loop for remote endpoint %A%%%u, tunnel name = %s. |
01850027 | MR: Proxy missing for %s %s |
01850028 | MR: Message drop due to wrong Hop-by-Hop ID (%u) |
01850028 | MR: Message dropped due to wrong Hop-by-Hop ID (%u) or End-to-End ID (%u) |
01850033 | MR: Message dropped because ingress queue full (flow %F) |
01850034 | MR: Ingress buffer full, closing TCP window (flow %F) |
01850035 | MR: Ingress buffer draining, opening TCP window (flow %F) |
01850036 | MR: Passthru_mode state %s side connection: %F is torn down or aborted, reason: %lE |
01850037 | MR: Server side connection %F is established and in passthru_enabled state |
01850038 | MR: Router %s iRule scope is per %s |
01850039 | MR: Diameter: Performing dynamic route lookup, destination host %.*s |
0185003a | MR: Diameter: Dynamic route lookup failed for %.*s (Reason: %E) |
0185003b | MR: Diameter: Dynamic route added for %.*s |
0185003c | MR: Diameter: Dynamic route for %.*s set to delete in %d seconds |
0185003d | MR: Diameter: Dynamic route for %.*s deleted |
0185003e | MR: Diameter: Dynamic route for %.*s updated, generation %d |
0185003f | MR: Priority set by the iRule MR::message priority, %d is out of range [1-4]. Changing it to the default value %d |
01850040 | MR: RATELIMIT Traffic rate in %s, crossed %s %s of configured threshold on %s |
01850041 | MR: RATELIMIT message id %llu delayed on %s |
01850042 | MR: RATELIMIT message id %llu returned on %s |
01850043 | MR: RATELIMIT message id %llu dropped on %s |
01850044 | MR: RATELIMIT message id %llu dropped due to exceeding delay on %s |
01850046 | MR: RATELIMIT slot %d : accumulated count : %ld |
01850047 | MR: RATELIMIT total count : %d |
01850048 | MR: Wrong pmbr_rem value is calculated. pmbr_rem: %lu, total active npus: %u |
01860000 | MR SIP: %s returned error: %lE |
01860001 | MR SIP: %s |
01860002 | MR SIP: Missing header %s in the message |
01860003 | MR SIP: Decrypt branch parameter failed with error : %lE |
01860004 | MR SIP: Encrypt branch parameter failed with error : %lE |
01860005 | MR SIP: %s |
01860006 | MR SIP: Invalid config attribute %s in profile %s |
01860007 | MR SIP: Generated response was not sent '%d - %s' (%F) |
01860008 | MR SIP: Generated response SENT '%d - %s' (%F) |
01860009 | MR SIP: Media flow creation (%F)<->(%F) failed due to collision |
0186000a | MR SIP: Parse error reading number for %s value near %d. Status Code %d |
0186000b | MR SIP: Parse error bad sip protocol version in headline near %d. Status Code %d |
0186000c | MR SIP: Parser error invalid or malformed uri in headline near %d. Status Code %d |
0186000d | MR SIP: Parser error invalid headline near %d. Status Code %d |
0186000e | MR SIP: Parser error too many header near %d. Status Code %d |
0186000f | MR_SIP: Parser error extraneous header field near %d. Status Code %d |
01860010 | MR_SIP: Parser error header too large near %d. Status Code %d |
01860011 | MR_SIP: Parser error missing header code %d. Status Code %d |
01860012 | MR_SIP: Parser error CSEQ method does not match headline tag %s : %s. Status Code %d |
01860013 | MR_SIP: Parser max-forwards value has reached zero. Status Code %d |
01860014 | MR_SIP: Server in maintence mode. Status Code 503 |
01860015 | MR_SIP: Loop detected. Status code 482 |
01860016 | MR_SIP: Missing Media Connection atributes. Status Code 488 |
01860017 | MR_SIP: Too many media sessions %d / %d. Error Code %d |
01860018 | MR_SIP: Ingress message queue full, current message dropped (flow %K) |
01860019 | MR_SIP: Ingress message queue full, closing TCP window (flow %K) |
0186001a | MR_SIP: Ingress message queue draining, opening TCP window (flow %K) |
01860026 | MR SIP: invalid address: %A |
01860027 | MR SIP: Rejecting SIP registration request due to PBA Block timeout blackout. %d seconds left in block, %d-second blackout period |
01860028 | MR SIP: Backdown of SIP registration request expiry due to PBA Block timeout. %d -> %d in message |
01860029 | MR SIP: Re-writing SIP REGISTER response expiration value from registrar due to PBA Block timeout. %d -> %d |
0186002a | MR_SIP: Non-SIP message received. Client connection %F is in fail_open_enabled state |
0186002a | MR_SIP: Non-SIP message received. Client connection %F is in passthru_enabled state |
0186002b | MR_SIP: Server side connection %F is established and in fail_open_enabled state |
0186002b | MR_SIP: Server side connection %F is established and in passthru_enabled state |
0186002b | MR_SIP: Media flow creation (%F)<->(%F), flow index %u, timeout %u s |
0186002c | MR_SIP: Fail_open_enabled state %s side connection: %F is torn down or aborted, reason: %lE |
0186002c | MR_SIP: Passthrough_enabled state %s side connection: %F is torn down or aborted, reason: %lE |
0186002c | MR_SIP: Media flow creation (%F)<->(%F) failed with error: %lE |
0186002d | MR_SIP: Media flow deletion (%F)<->(%F) |
0186002e | MR_SIP: Subscriber registration created: subscriber URI %s |
0186002f | MR_SIP: Subscriber registration deleted: subscriber URI %s |
01860030 | MR_SIP: Subscriber registration updated: subscriber URI %s, lifetime %u s |
01860031 | MR_SIP: Non-Registered Subscriber registration created: subscriber URI %s |
01860032 | MR_SIP: Non-Registered Subscriber registration updated: subscriber URI %s, lifetime %u s |
01860034 | MR_SIP: Routing to topmost Route Header address and port: %A:%d |
01860035 | MR_SIP: %s mode with SIP ALG |
01890008 | Postgres stopped with a non-zero status (%d). |
0189000b | Shutting down postgres. |
018e0002 | %s |
018e0005 | Exiting, received shutdown signal |
018e0017 | %s |
018e001d | %s |
018e001e | %s |
01900006 | Profile SCTP error: SCTP %s missing from message. |
01900020 | SCTP %s association (%F) confirmed peer transport address %la. |
01900021 | SCTP %s association (%F) peer transport address %la not confirmed, path %F inactive. |
01900022 | SCTP %s association (%F) %s path %F failed (path-retransmit-exceeded). |
01900023 | SCTP %s association (%F) %s path %F failed (destination unreachable). |
01900024 | SCTP %s association (%F) path %F restored. |
01900025 | SCTP %s association (%F) primary path changed to %F. |
01900026 | SCTP %s association (%F) path %F usable. |
01900027 | SCTP %s association (%F) %s path %F not usable (path-retransmit-exceeded). |
01900028 | SCTP %s association (%F) %s path %F not usable (destination unreachable). |
01900029 | SCTP %s association (%F) failed (association-retransmit-exceeded). |
01900030 | SCTP %s association (%F) initialization failed (init-retransmit-exceeded). |
01900031 | SCTP %s association (%F) aborted by peer. |
01900032 | SCTP %s association (%F) aborted (%s). |
01900035 | SCTP %s association %s (%F) path %F restored. |
01910001 | Tmrouted starting. |
01910014 | FATAL error: non_initial state (%d) and some state vars are unknown (cluster: %d, primary: %d) |
01910030 | FATAL error: failed to set timer %p at %s:%d |
01910031 | FATAL error: failed to clear timer %p at %s:%d |
01910032 | FATAL error: attempt to set already active timer %p at %s:%d |
01910033 | FATAL error: attempt to clear inactive timer %p at %s:%d |
01910034 | FATAL error: attempt to clear wrong timer %p at %s:%d |
01910035 | FATAL error: timer array exceeded |
01910036 | FATAL error: RHI failed to send %s request. |
01910037 | Tmrouted clean up timed out while shutting down. |
01910050 | error on cluster socket %d in state %d: %s |
01910202 | failed to add attribute %u to NETLINK message. got: %d need: %zu |
01910204 | memory allocation failed for %s: trying %zu bytes |
01910300 | HA daemon heartbeat disabled. Last value is %u. |
01910301 | HA daemon heartbeat enabled with %us period. Last value is %u. |
01910600 | Suppressing route %s matching admin network. |
01910601 | Unsuppressing route %s matched previous admin network. |
01910602 | Failed to suppress route %s matching admin network. |
01910603 | Withdrawing route %s matching admin network not suppressed. |
01910604 | New route %s matching admin network already suppressed. |
01940007 | "Failed to allocate the errdefs tmconf handle!" |
0194000b | "errdefs: error adding local syslog destination %s; check the configuration for missing elements." |
0194000c | "errdefs: error adding remote syslog destination %s; check the configuration for missing elements." |
0194000d | "errdefs: error adding remote hsl destination %s; check the configuration for missing elements." |
0194000e | "errdefs: error adding fslog destination %s; check the configuration for missing elements." |
0194000f | "errdefs: error adding alertd destination %s; check the configuration for missing elements." |
01940010 | "errdefs: failed to add splunk destination %s -- the delivering destination %s probably doesn't exist or contains errors." |
01940011 | "errdefs: error adding IPFIX destination %s; check the configuration for missing elements." |
01940012 | "errdefs: failed to add splunk destination %s -- the delivering destination %s probably doesn't exist or contains errors." |
01940019 | "Unable to connect to MCPD, will try again in 30 seconds." |
0194001d | Errdefsd is starting. |
01940022 | errdefs: error adding management port destination %s; check the configuration for missing elements. |
01960002 | netHSM: Failed to login to network HSM with login_status[%lu]. |
01960004 | netHSM: Failed login: password[%s]. Error[%lu]. |
01960005 | netHSM: The session with the network-hsm is invalid. |
01960005 | netHSM: The session with the network-hsm is invalid. |
01960006 | netHSM: Failed to open file [%s]. |
01960007 | netHSM: Unknown client [%d]. |
01960008 | netHSM: Thales RFS error [%s]. |
01960009 | netHSM: Failed to allocate space [%u] for [%s]. |
01960010 | netHSM: Unknown HSM vendor [%s]. |
01960011 | netHSM: BigDB error [%d][%s]. |
01960012 | netHSM: PKCS11d (re)initialization is not complete. |
01960013 | netHSM: PKCS11d stopped. Verify password, and restart PKCS11d. |
01960014 | netHSM: Error: %s. |
01960014 | netHSM: Key name is too long (>=255). |
01960015 | netHSM: Input string(%s) is too long (>=255). |
01960016 | netHSM: Failed to create ec key for key %llu |
01960017 | netHSM: Failed to set ec group for key %llu |
01960018 | netHSM: Failed to create ec point for key %llu |
01960020 | %s: file name too long (module: %s, dir: %s). |
01960021 | dlopen returned %s for module %s. |
01960022 | module %s is invalid (attach function missing). |
01960023 | %s(): mod_err = 0x%x |
01960030 | N3FIPS: Couldn't get curve id for key %PRId64 (%s, err=%u) |
01960031 | N3FIPS: Couldn't create group for curve id %u |
01960032 | N3FIPS: Couldn't get group order for curve id %u |
01960033 | N3FIPS: Couldn't get qx/qy for key %PRId64 (%s, err=%u) |
01960034 | N3FIPS: Couldn't read qx/qy for key %PRId64 |
01960035 | N3FIPS: Couldn't export key %PRId64 (%s) |
01960036 | N3FIPS: Couldn't set the ec group for key %PRId64 |
01960037 | N3FIPS: Couldn't retrieve curve id for label '%s' |
01960038 | N3FIPS: Couldn't assign ec_key to pkey for label '%s' |
01960039 | N3FIPS: Couldn't convert to bio_key. |
01960040 | N3FIPS: Couldn't read from the bio_key. |
01960041 | N3FIPS: Couldn't import private key (err=%u, reason='%s'). |
01960042 | N3FIPS: Unsupported curve id %u. |
01960043 | N3FIPS(mem): Couldn't create octet string for key %PRId64 |
01960044 | N3FIPS(mem): Couldn't export key %PRId64 |
01960045 | N3FIPS(mem): Couldn't create ec key for key %PRId64 |
01960047 | N3FIPS(mem): Couldn't create memory BIO. |
01960048 | N3FIPS(mem): Couldn'tgenerate a PEM buffer. |
01960049 | N3FIPS(mem): Failed to allocate PEM string of %zu bytes. |
01960050 | N3FIPS(mem): Couldn't duplicate ec_key for label '%s' |
01960051 | N3FIPS(mem): Couldn't allocate pkey for label '%s' |
01960052 | N3FIPS(mem): Couldn't allocate bio_key for label '%s' |
01960053 | N3FIPS(mem): Couldn't allocate bin_key for label '%s' |
01960054 | N3FIPS(mem): Couldn't allocate a FIPS request record. |
01a30018 | (%s). err(%d)(%s) |
01a30019 | read error (%s)/(%d)/(%d) (%d)(%s) |
01a3001a | write error (%s)/(%d)/(%d)(%d)(%s) |
01a3001b | Collecting pool member %s status monitor: %d session: %d |
01a30025 | The database has become inconsistent! |
01a30040 | Reconnected to TAM server after %d attempts |
01a3004b | Missing rd(%s) for vlan(%s) |
01a3004c | Virtual server (%s) is configured with unexpected virtual server type (%d) |
01a3004d | Error: load balance mode invalid for pool %s used by virtual %s - changed to Round Robin load balancing |
01a3004e | Error (%s) node(%s) |
01a3004f | node(%s) state(%s) |
01a30050 | Failed to post from(%s) to(%s) message (%d)/(%s) error: (%s) |
01a30051 | Failed to alloc (%s) for (%d)bytes context(%s) err(%d)/(%s) |
01a40000 | Failed to create IVS (%s). |
01a40001 | Failed to create OCSP context - %s, with error: %E. |
01a40002 | Failed to create OCSP request with OCSP object(%s), certificate(%s). |
01a40003 | HTTP status code of OCSP response(%d) indicates failure to obtain the response for certificate(%s). |
01a40004 | OCSP validation result of certificate(%s): OCSP response - (%s), certificate status - (%s), lifetime - %u. |
01a40008 | Unable to build certificate trust chain for profile %s |
01a40008 | %s |
01a40009 | Certificate(%s) has expired, or is going to expire in less than a week. |
01a50024 | Node to corrupt %s is invalid |
01a50027 | The revoke option is only available on VE platforms. |
01a50031 | Manifest created is larger than 512K: %u |
01a50033 | Unable to parse the manifest with a json parser. |
01a50034 | Failed to get variables from mcpd: %s |
01a50035 | Failed to to connect to mcpd. |
01a50100 | Error: Failed to store EULA in %s. |
01a50101 | Error: Failed to install backup file %s to %s. |
01a50102 | Error: Failed when calling /usr/bin/chcon for %s. |
01a50111 | Error: Server busy, retry in %d seconds. |
01a60001 | |
01a70028 | The platform was not found in %s. |
01a70029 | CCN is unsupported on vcmp guests. |
01a70077 | Error: OpenSSL PEM_read_bio_PrivateKey failed read key %s. |
01a70095 | Error: OpenSSL EVP_PKEY_get1_RSA failed. |
01a70096 | Error: OpenSSL RSA_check_key(%s) failed. |
01a70097 | Error: OpenSSL BN_new failed. |
01a70098 | Error: OpenSSL RAND_file_name failedo_RSAPrivateKey. |
01a70121 | Error: Failed while getting the status, %s. |
01a70122 | Error: Failed to obtain auto-check/auto-phonehome status. |
01a70131 | Error: Failed to obtain certificate cache path. |
01a70132 | Error: Failed while gettting the certificate cache path, %s. |
01a70133 | Error: Failed to obtain key cache path. |
01a70134 | Error: Failed while gettting the key cache path, %s. |
01a70141 | Error: Can't connect to mcp, %s. |
01a70151 | Error: OpenSSL RAND_status failed. |
01a70152 | Error: OpenSSL RSA_new failed. |
01a70153 | Error: OpenSSL BN_set_word failed. |
01a70154 | Error: OpenSSL RSA_generate_key_ex failed. |
01a70155 | Error: OpenSSL RAND_write_file failed. |
01a70156 | Error: OpenSSL PEM_write_bio_RSAPrivateKey for key %s failed. |
01a70170 | Error: Failed to obtain key passphrase from mcpd for key %s. |
01a70171 | Error: system call to tmsh save sys config. |
01a70172 | Error: Failed to create cached key file. |
01a70173 | Error: Failed to create cached certificate file. |
01a70180 | Error: Attempted to get cloud environment when not on cloud. |
01a70181 | Error: Failed to communicate with %s to obtain metadata. |
01a90007 | dynconf setrlimit %d failure: %s. |
01a90008 | dynconf setrlimit %d error: %s %d. |
01aa0000 | ICAP (%F): Incomplete message body received from server |
01aa0001 | ICAP (%F): Unexpected status code %u received from server |
01aa0002 | ICAP (%F): Server responded 204 beyond or without preview ('Allow: 204' is not supported) |
01aa0003 | ICAP (%F): Parsing ICAP response headers failed |
01aa0004 | ICAP (%F): Parsing ICAP chunked response body failed |
01aa0005 | ICAP (%F): Status code %u received from server |
01aa0006 | ICAP (%F): Response completed after request completed - connection may be reused by 'oneconnect' |
01aa0007 | ICAP (%F): Response completed before request - request truncated and oneconnect reuse disabled |
01aa0008 | ICAP (%F): An IVS result was imposed during iRule event %s - ICAP transaction terminated |
01aa0009 | ICAP (%F): An iRule parked at event %s |
01aa0010 | ICAP (%F): Processing message %s failed: %s |
01aa0011 | ICAP (%F): Processing ingress from IVS failed: %s |
01aa0012 | ICAP (%F): Processing egress from server failed: %s |
01aa0013 | ICAP: Client-facing state transition %s -> %s |
01aa0014 | ICAP: Server-facing state transition %s -> %s |
01ad0001 | Monitor Agent TMM %u: channel could not be opened: error %s(%s) |
01ad0003 | Monitor Agent TMM %u: channel could not be authenticated: error %s(%s) |
01ad0013 | Monitor Agent TMM %u: failed to handle %s message: MID %u, error %s(%s) |
01ad0014 | Monitor Agent TMM %u: created activity: MID %u, proto %s, endpoint %A:%u, monitor %s |
01ad0015 | Monitor Agent TMM %u: failed to create activity: proto %s, endpoint %A:%u, monitor %s |
01ad0016 | Monitor Agent TMM %u: deleted activity: MID %u, monitor %s |
01ad0017 | Monitor Agent TMM %u: sent probe: MID %u |
01ad0018 | Monitor Agent TMM %u: failed to send probe: MID %u, monitor %s |
01ad0019 | Monitor Agent TMM %u: received probe response: MID %u, reason %s(%s), info %#x |
01ad0020 | Monitor Agent TMM %u: probe response timeout: MID %u |
01ad0021 | Monitor Agent TMM %u: created/enlarged monitor table for %u entries |
01af0004 | Traffic rejected for hornet virtual (%s) |
01b00001 | %s: class name (%s) field name (%s) |
01b00002 | internal error - %s |
01b00003 | Full sync for devicegroup %s on connection %p complete; sending updated sync. |
01b00004 | There is an unfinished full sync already being sent for device group %s on connection %p, delaying new sync until current one finishes. |
01b00005 | Incremental sync request received for device group (%s) from device (%s) cannot be processed because an earlier incremental sync request failed. |
01b10000 | DSCPROXY: failed to allocate new %s. |
01b10001 | DSCPROXY: Attempting connect - remote_ip %A, local_ip %A, port %d. |
01b10001 | Failed to restart nslcd: %s |
01b10002 | DSCPROXY: Connection attempt failed to %la port %u: %E. |
01b10003 | DSCPROXY: Connection with peer %la:%d failed TLS handshake. |
01b10004 | DSCPROXY: Connection with peer %la:%d closed. |
01b10005 | DSCPROXY: Connection with peer %la:%d lost. |
01b10006 | DSCPROXY: Reconnect with peer %la:%d stuck in delay. |
01b10007 | DSCPROXY: %s connection with peer %la:%d established. |
01b10008 | DSCPROXY: Cannot connect to peer because local address is %s (%la) and remote address is %s (%la). |
01b30001 | Failed to configure iptables rules for config sync CGC routing: %s |
01b30002 | Configured iptables rules for config sync CGC routing: %s |
01b30003 | Config sync over the management port requires big3d, which is not currently running. Config sync will not work until big3d is running. |
01b40001 | A cipher group must be configured when TLS 1.3 is enabled (validation failed for %sprofile %s). |
01b40002 | Configuration error: sslo log configuration (%s) is part of system configuration, so it cannot be deleted. |
01b40017 | Configuration error: Virtual Server (%s) with Access Profile of type sslo is not compatible with profile of type (%s). |
01b40018 | Configuration error: Access Profile of type sslo is not compatible with exchange profile. |
01b4001d | The listen-ip or listen-port must not be zero in splitsession server profile %s for virtual server %s. |
01b4001e | The peer-ip or peer-port must not be zero in splitsession client profile %s for virtual server %s. |
01b4001f | Invalid value (%s) for profile %s field %s. Only integers between %d and %d are permitted. |
01b40020 | Invalid retransmission queue limits (high = %d, low = %d) High must be greater than low, and as they represent percentages, they both must be between 0 and 100. |
01b40021 | Invalid unroutable options selected. Only one of 'Discard' and 'Respond' may be selected. |
01b40023 | Virtual Server (%s) cannot use both an Access profile and an Anti-Fraud profile. |
01b40024 | Virtual Server (%s) of type Internal contains an HTTP profile. It must also contain a Service profile. |
01b40025 | Virtual Server (%s) contains a Fraud Protection profile and a Service profile. The Service profile must be of type F5 Module. |
01b40027 | On profile (%s) with GMSSL enabled: no-tls, no-ssl, and no-dtls must be selected. |
01b40028 | On profile (%s): Invalid SSL option (%s) found. |
01b40029 | Client SSL profile (%s): %s is not RSA %s. To add non-RSA cert/key, please use [cert-key-chain add]. |
01b4002a | Client SSL profile (%s):%s and profile %s options cannot be specified together. |
01b4002b | Client SSL profile (%s): the profile has no RSA cert/key pair that can be modified. To add RSA cert/key, please use [cert-key-chain add]. |
01b4002c | Client SSL profile (%s): inherit-cert-key-chain and cert/key can not be set together. |
01b4002d | Client SSL profile (%s): SM2 certitificate and key type is incompatible with other crtificate and key types. |
01b4002e | Client SSL profile (%s): SM2 certificate and key type is incompatible with SSL forward proxy mode. |
01b4002f | Client SSL profile (%s): un-licensed certificate and key type. |
01b40030 | Client SSL profile (%s): cert-key-chain (%s): SM2 certificate and key can not be used as forward proxy CA. |
01b40033 | Server SSL profile (%s): SM type %s (%s) is not allowed in a serverSSL profile. |
01b40034 | Clieint SSL profile (%s): Un-licensed type %s (%s). |
01b40035 | Cipher Group (%s): %s can not be used with other %s together in one cipher group. |
01b40036 | SSL profile (%s): A cipher group must be configured when GMSSL is enabled. |
01b40037 | Virtual Server (%s): GMSSL clientSSL profile (%s) and non-GMSSL clientSSL profile (%s) cannot be configured in the same virtual server. |
01b40039 | %s critical message rate limit threshold (%u) must be greater than major message rate limit threshold (%u). |
01b4003c | The addresses within the specified address list(%s) have different route domains. |
01b4003e | Server SSL Profile (%s): %s response control cannot be set to mask when forward proxy is disabled |
01b4003f | VLAN(%s) and tmc have different route-domain |
01b40040 | TMC(%s) and %s have different route domain. |
01b40041 | Policy: '%s' Rule '%s' Condition '%s', Option 'use case sensitive string comparison' not supported for data type '%s'. |
01b40042 | The virtual server %s cannot support SSL persistence since SSL profile %s has zero cache-size. |
01b40042 | Cannot add record to an external data group (%s). |
01b40043 | Traffic-group of Virtual-address(%s) associated with Virtual Server(%s) cannot be updated. |
01b40044 | Virtual Server(%s) cannot have Virtual-address(%s) associated with different traffic groups. |
01b40046 | Base profile (%s) may not be assigned to a virtual server (%s) |
01b40047 | Cannot create TDR filter '%s' inside TDR profile '%s', maximum limit 255 reached. |
01b40048 | TDR filter '%s' has invalid TDR format %s (%s) |
01b40049 | MR RateLimit profile '%s' has invalid configuration (%s). |
01b4004b | DNS Cache dlv-anchors has been deprecated, removing from the configuration. |
01b4004c | Invalid Transparent Nexthop configuration,VLAN (%s) %s |
01b50001 | VE 1NIC Self IP configuration error: %s |
01b50002 | The label '%s' is longer than the %u characters specified by the PKCS11 Standard. |
01b50003 | Certificate (%s) is not generated from the key (%s). |
01b50004 | Certificate signing request (%s) is not generated from the key (%s). |
01b50005 | Key (%s) access requires passphrase. |
01b50009 | Certificate order manager (%s) certificate authority (%s) requires client certificate and key to access the account. |
01b50010 | Certificate order manager (%s) fields (%s) should be empty for the selected certificate authority (%s). |
01b50011 | Certificate order manager (%s) empty order-info. Please provide a valid order-info corresponding to the CA. |
01b50012 | Certificate order manager (%s) invalid order-info for Certificate Authority (%s).\n%s. |
01b50015 | Certificate order manager (%s) certificate authority (%s) order-info field (%s) value (%s) is not valid. Allowed values are (%s). |
01b50016 | Certificate order manager (%s) certificate authority (%s) order-info field (%s) value (%s) is not valid. An Integer value is expected. |
01b50017 | Certificate order manager (%s) certificate authority (%s) order-info field (%s) value (%s) is not valid. An integer value within range (%d-%d) is expected. |
01b50018 | Certificate order manager (%s) CA certificate (%s) is invalid. %s. |
01b50019 | Certificate order manager (%s) client certificate key pair is mismatched.\n%s |
01b50020 | Key (%s) cert-order-manager revoke-reason should not be empty for certificate revoke. |
01b50020 | Key (%s) cert-order-manager cannot be deleted when order-status is in 'pending'. |
01b50021 | Key (%s) cert-order-manager association is being deleted while order-type (%s) is in progress. |
01b50022 | Key (%s) cert-order-manager order-status should be in 'pending' to check-status. |
01b50022 | Key (%s) cert-order-manager order-status should not be in 'pending' while deleting key. |
01b50022 | Key (%s) cert-order-manager order-id should be valid to download a certificate. |
01b50023 | Key (%s) is being deleted while order-type (%s) is in progress. |
01b50027 | Key (%s) changing order-type to (%s) is not allowed as there is order-type (%s) in progress. |
01b50028 | Key (%s) cert-order-manager order-type(%s) needs a valid certificate signing request (CSR) with name (%s). %s |
01b50029 | CSR (%s) is being deleted while key (%s) cert-order-manager order-type (%s) is in progress. |
01b50030 | Key (%s) cert-order-manager current order-type (%s) cannot be canceled. |
01b50032 | Certificate order manager (%s) base-url should not include authentication information. |
01b50033 | Certificate order manager (%s) additional header %s. Expected configuration '%s'". |
01b50034 | Certificate order manager (%s) internal proxy should not be empty. |
01b50034 | Key (%s) Certificate order manager (%s) authority (%s) requires challenge passphrase for submitting the order. |
01b50035 | Key (%s) cert-order-manager certificate authority (%s) order-passphrase requirements not met.%s |
01b50036 | Key (%s) cert-order-manager order-passphrase not required for certificate authority (%s). |
01b50037 | Key (%s) cert-order-manager order-type should not be changed along with check-status. |
01b50037 | Key (%s) cert-order-manager order-type should not be changed while downloading certificate. |
01b50038 | Certificate order manager (%s) CA certificate should not be empty. |
01b50039 | Key (%s) certificate order manager order-id should not be empty while making a renewal order. |
01b50040 | System generated key (%s) should not be associated with certificate order manager. |
01b50041 | Certificate order management is disallowed on key (%s) as its folder (%s) is associated with a sync-only device-group (%s). This operation is allowed on folders associated with sync-failover device-group or if the device-group on the folder is set to none. |
01b50042 | Certificate order manager (%s) - Certificate authority is not allowed to be modified. Please create a new certificate order manager if a different certificate authority is needed. |
01b50043 | Certificate order manager (%s) has invalid (%d) validity-days. %s |
01b50044 | No symmetric unit key found for guest %s. |
01b50045 | Generating symmetric unit key failed (%s). |
01b50046 | Encrypting symmetric unit key failed. |
01b50047 | Setting DB variable %s to %s. No rebooting needed. |
01b50047 | The system auth source type (%s) does not support rewrite system-auth for update on auth password policy. |
01b50048 | Certificate order manager (%s) certificate authority (%s) security token is invalid. %s |
01b50048 | %s changing OpenSSL FIPS flag from (%d) to (%d). No rebooting needed. |
01b60001 | No cipher match found in '%s' |
01b60002 | No TLS version match found in '%s' |
01b60003 | QoS Round-trip time and Hops can't both have non-zero values. |
01b60004 | DNSSEC External Zone (%s) must be a descendant of DNSSEC Zone (%s). |
01b60005 | DNSSEC External Zone (%s:%s) duplicates existing DNSSEC zone (%s) with the same name (case-insensitive and unique across folders). |
01b60006 | DNSSEC External Zone (%s:%s) duplicates existing external zone (%s:%s) with the same name (case-insensitive). |
01b60007 | DNSSEC External Zone (%s) references a nonexistent DNSSEC zone (%s) |
01b60008 | DNSSEC Zone %s duplicates existing external zone (%s:%s) with the same name (case-insensitive). |
01b60009 | Unable to parse DNSSEC secure delegation record (%s:%s):%s (%s). |
01b6000a | DNSSEC external secure delegation record (%s:%s) has DS with different owner name: %s. |
01b6000b | At least one ds-algorithm must be specified. |
01b6000c | DNSSEC External Zone (%s) must contain at least one DS record string. |
01b6000d | DNSSEC External Zone (%s) contains a duplicate DS record (%s). |
01b6000e | DNSSEC External Zone (%s) DS record string (%s) contains a non-IN class type (%s). It must be 'IN'. |
01b6000f | DNSSEC External Zone (%s) DS record string (%s) contains a non-DS resource record type (%s). It must be 'DS'. |
01b60010 | DNSSEC External Zone (%s) DS record string (%s) contains an invalid digest type (%s). It must be an integer in the range of 1 - 2. |
01b60011 | DNSSEC External Zone (%s) DS record string (%s) contains an invalid key tag (%s). It must be an integer in the range of 0 - 65535 and match that of the corresponding DNSKEY RR. |
01b60012 | DNSSEC External Zone (%s) DS record string (%s) contains an invalid DNSKEY algorithm (%s). It must be an integer in the range of 3 - 255 and match that of the corresponding DNSKEY RR. |
01b60013 | DNSSEC External Zone (%s) DS record string (%s) contains an invalid TTL (%s). It must be an integer in the range of 0 - 2147483647. |
01b60014 | DNSSEC External Zone (%s) DS record string (%s) is missing the DNSKEY digest. |
01b60015 | Topology order value (%u) ignored because longest match is enabled. |
01b60016 | Cannot specify order (%u) that is greater than the number of topology records (%u) |
01b60018 | DS record is not a valid attribute for external insecure zone %s |
01b60019 | DNSSEC SEP Record is missing %s. |
01b6001a | DNSSEC FIPS manager could not parse %s key file (%s) |
01b6001b | Handling request for dnssec generation of key %s with id %llu. %s. |
01b6001c | Failed to handle request for new dnssec key generation: Invalid primary key in request for DNSSEC Key Generation. |
01b6001d | Failed to handle request for new dnssec key generation: Non existent key %s. |
01b6001e | Invalid control character %u found in GTM object with name %s. |
01b6001f | DNS monitor '%s' has invalid parameter value '%s' |
01b60020 | Found invalid configuration for DNSSEC zone %s %s RR types. |
01b60020 | Failed to decrypt private text of DNSSEC Key Generation %llu of key %s. |
01b60021 | Configured DNSSEC Zone %s bitmap types are missing required default RR types. Required defaults are %s. |
01b60021 | DNSSEC Key %s cannot have manual key management and HSM at the same time. |
01b60022 | Last resort pool name not specified for Wide IP %s |
01b60023 | Last resort pool type not specified for Wide IP %s |
01b60024 | DNSSEC Key %s of ECDSA algorithm not supported for Thales HSM. |
01b60025 | The bit-width field is not applicable for ECDSA algorithms. |
01b70001 | Per-request policy (%s) should have only one per-req-policy-properties object |
01b70002 | Policy (%s) of type %s cannot have per-req-policy-properties attached, policy type must be %s. |
01b70003 | Discovery interval (%u) for OAuth provider (%s) must be greater than (%u) minutes. |
01b70005 | oneshot_macro attribute for the requested object (%s) can be set to true only for access policy of type per request macro and per request sslo macro. |
01b70008 | JWK config (%s) is configured to use client secret for key type octet. Hence, this cannot be used as %s in %s (%s). |
01b7000b | OAuth claim object (%s) has an invalid value (%s). When claim-type is set to '%s', allowed value is %s or a valid session variable. |
01b7000c | Access Profile or Per-Request Policy cannot be attached to virtual (%s) when API Protection profile is attached. |
01b7000d | In API Protection Profile (%s), Last Generated Path ID value (%d) must be greater than or equal to its previous value (%d). |
01b7000e | In API Protection Profile (%s), Last Generated Path ID should be provided when setting Path ID manually(%d) in the children Path object. |
01b7000f | In API Protection Profile (%s), Path ID (%d) in the children Path object should not be greater than Last Generated Path ID (%d) value. |
01b70010 | In API Protection Profile (%s), children Path object has path_id modified to '%d'. Updating Path ID for an exisitng API Protection Profile Path object is not allowed. |
01b70011 | Access profile (%s) is of type api-protection and cannot be attached via the access profile link. API protection profiles must be directly attached to the Virtual Server. |
01b70012 | Per request policy (%s) is of type api-protection and cannot be attached via the per request policy link. API protection profiles must be directly attached to the Virtual Server. |
01b70013 | Once an access profile has been associated to an API Protection profile (%s), a new access profile (%s) cannot be attached. |
01b70014 | Once a per request policy has been associated to an API Protection profile (%s), a new per-request policy (%s) cannot be attached. |
01b70015 | Access profile (%s) attached to the API protection profile (%s) must be of type api-protection. |
01b70016 | Per request policy (%s) attached to the API protection profile (%s) must be of type api-protection. |
01b70017 | API Server (%s) cannot be attached to two API protection profiles (%s and %s). |
01b70018 | DNS Resolver must be attached if a server is present on API protection profile (%s). |
01b7001a | In API Protection Profile (%s), Path ID (%d) is not allowed. Path ID must be unique for the API protection profile. |
01b7001b | In API Protection Profile (%s), Path ID (%d) value is out of bounds. Valid value must be between (0) and (%d). |
01b7001c | In API Protection Profile (%s), path ID cannot be generated for child path object. Maximum allowed value (%d) is reached |
01b7001d | Response (%s) cannot be attached to two API protection profiles (%s and %s). |
01b7001e | Default response cannot be empty in API protection profile (%s). |
01b7001f | Default response (%s) must be a part of responses associated with the API protection profile (%s). |
01b70020 | API Protection base profile (%s) cannot be modified or deleted. |
01b70021 | Invalid URL (%s) for API Server (%s): %s. |
01b70022 | If URL (%s) is of https scheme, serverssl profile must be present in API Server (%s). |
01b70023 | Status code cannot be empty in Response Config (%s). |
01b70024 | Status string cannot be empty in Response Config (%s). |
01b70025 | Response Config (%s) cannot have 'Connection' header present. |
01b70026 | Response Config (%s) cannot have 'Content-Length' header present. |
01b70027 | In API Server Selection Agent (%s), Server (%s) selected must be part of servers associated with the API protection Profile (%s). |
01b70028 | %s (%s) cannot be configured to use SSO Config (%s) since the SSO method is not supported for API Protection. Use SSO Config with SSO method configured for one of 'HTTP Basic', 'Kerberos' or 'OAuth Bearer'. |
01b70029 | In %s Agent (%s), Response (%s) selected must be part of responses associated with the API protection Profile (%s). |
01b7002a | Invalid URI (%s) in Path (ID = %d) for API Protection Profile (%s): %s. |
01b7002b | Method cannot be empty in Path (ID = %d) for API Protection Profile (%s). |
01b7002c | This combination of URI (%s) and method (%s) must be unique in API Protection Profile (%s). |
01b7002d | In API Protection profile (%s), Response (%s) cannot be deleted since it is used in %s (%s). |
01b7002e | In API Protection Profile (%s), Server (%s) cannot be deleted since it is used in %s (%s). |
01b7002f | %s (%s) cannot be attached to two API protection profiles (%s and %s). |
01b70030 | Status code (%s) in Response Config (%s) does not contain valid session variable. |
01b70031 | Status string (%s) in Response Config (%s) does not contain valid session variable. |
01b70032 | Header (%s) in Response Config (%s) does not contain valid session variable. |
01b70033 | Header value (%s) in Response Config (%s) does not contain valid session variable. |
01b70034 | Response body (%s) in Response Config (%s) does not contain valid session variable. |
01b70035 | The virtual server (%s) must have an HTTP profile assigned to it before you can associate an API protection profile. |
01b70036 | You cannot associate the base API protection profile with the virtual server (%s). |
01b70037 | Header name and header value in response (%s) cannot be empty. |
01b70038 | In the API Protection Profile (%s), the path (ID = %d) refers to an API Server (%s) that is not part of this profile. |
01b70039 | In SSO config '%s',scope value(%s) contains invalid characters. Valid values are session variables or ASCII character set (0x21/ 0x23-0x5B/ 0x5D-0x7E). |
01b7003a | OpenID Connect should not be enabled for '%s' grant in agent '%s' |
01b7003b | Unable to find customization source (%s) for customization group (%s). |
01b7003c | Deletion of customization source (%s) is prohibted. Object must always be present. |
01b7003d | Per-request access policy (%s) is not referenced by any existing customization group set |
01b7003e | The customization group set (%s) cannot share an access policy (%s) with other customization group set (%s). |
01b7003f | Access policy name cannot be changed in customization group set (%s) |
01b70041 | DoS profile (%s) is already referenced by another API protection profile. |
01b70041 | %s profile (%s) is already referenced by another API protection profile. |
01b70041 | In API Protection Profile (%s), the Base Path (%s) is invalid: uri path must start with a '/' and cannot contain invalid characters. |
01b70042 | DoS profile (%s) is already attached to a virtual server. |
01b70042 | %s profile (%s) is already attached to a virtual server. |
01b70042 | When force-authn is set to session-var-setting, force-authn-session-var cannot be empty in agent (%s) |
01b70043 | Bot defense profile (%s) is already referenced by another API protection profile. |
01b70043 | Another DoS profile is already attached to virtual server (%s). |
01b70043 | Force-authn session variable (%s) in agent (%s) is not in session variable format |
01b70044 | Bot defense profile (%s) is already attached to a virtual server. |
01b70044 | Cannot attach DoS profile to virtual server (%s). It is assigned to API protection profile (%s) |
01b70044 | API Rate Limiting Config (%s) contains invalid Quota Interval (%d). Quota Interval must be between 1 and 60 minutes. |
01b70045 | Cannot dettach DoS profile from virtual server (%s). It is assigned to the attached API protection profile |
01b70045 | API Rate Limiting Config (%s) contains invalid Spike Interval (%d). Spike Interval must be between 1 and 60 seconds. |
01b70046 | API Rate Limiting Config (%s) contains invalid Max Quota Requests (%s). Max Quota Requests must be a valid number or a subsession /perflow variable. |
01b70047 | API Rate Limiting Config (%s) contains invalid Max Spike Requests (%s). Max Spike Requests must be a valid number or a subsession /perflow variable. |
01b70048 | API Rate Limiting Config (%s) cannot be attached to two API protection profiles (%s and %s). |
01b70049 | API Rate Limiting Key (%s) cannot be attached to two API protection profiles (%s and %s). |
01b7004a | In API Protection Profile (%s), Rate Limiting Config (%s) cannot be deleted since it is used by one or more Rate Limiting Configuration entry in API Rate Limiting Agent (%s). |
01b7004b | In API Rate Limiting Agent (%s), Rate Limiting Config (%s) selected must be part of rate limiting configurations associated with the API protection Profile (%s). |
01b7004c | In API Rate Limiting Agent (%s), Weight assigned (%d) to Rate Limiting Config (%s) is invalid. Weight must be greater than 0 and less than the Quota/ Spike limit value in corresponding Rate Limiting Config. |
01b7004d | In API Protection Profile (%s), the Black/White list (%s) refers to Rate Limiting Key (%s), which is required to exist in the same profile. |
01b7004e | Key Name (%s) configuration is invalid for the Rate Limiting Key (%s). Key Name must be unique for all the Rate Limiting Keys in an API Protection Profile (%s). |
01b7004f | In the API Protection Profile (%s), a Rate Limiting Config (%s) refers to an API Rate Limiting Key (%s) that is not part of this profile. |
01b70050 | In API Rate Limiting Config (%s), Max Quota Requests is required when Enable Quota is true |
01b70051 | In API Rate Limiting Config (%s), Max Spike Requests is required when Enable Spike Limit is true |
01b70052 | In API Protection Profile (%s), Rate Limiting Key (%s) cannot be deleted since it is an auto-generated key. |
01b70053 | API Rate Limiting Key (%s) cannot be deleted as it is associated with Rate Limiting Config (%s). |
01b70054 | Rate Limiting Config (%s) must have a Rate Limiting Key attached when associated to an API Protection Profile (%s). |
01b70055 | In the API Protection Profile (%s), the Blacklist or Whitelist (%s) must have an API Rate Limiting Key attached. |
01b70056 | %s (%s) associated with %s (%s) does not exist. |
01b70057 | Empty Rate Limiting Config. Must select a rate limiting configuration associated with the API protection Profile. |
01b70058 | API Protection Profile (%s) had an unexpected default rate limiting response (%s) during upgrade. |
01b70059 | APM must be provisioned when a Virtual Server is using an API Protection Profile (%s) that has a reference to the access profile. |
01b7005b | APM Network Access (%s) DNS name (%s) is not a valid domain name. |
01b7005c | Not allowed to create or modify SWG Scheme (%s) because the swg-scheme object is deprecated. |
01b7005d | Ephemeral Authentication (%s) requires using either LDAP or RADIUS authentication, or both. |
01b7005d | The requested otp source (%s) is invalid: %s |
01b7005e | Expiry time (%u) of the password for Ephemeral Authentication (%s) must be in the range of %u-%u. |
01b7005f | Minimum length (%u) of the password for Ephemeral Access Configuration (%s) must be at least %u. |
01b70060 | Maximum length (%u) of the password for Ephemeral Access Configuration (%s) cannot be larger than %u. |
01b70061 | Minimum length (%u) of the password must be less than or equal to the maximum length (%u) for Ephemeral Access Configuration (%s). |
01b70062 | Minimum length (%u) of %s must be an integer no larger than %u for Ephemeral Access Configuration (%s). |
01b70063 | Total number of uppercase, lowercase, digits, and special characters (%u) exceeds the maximum length (%u) of the password for Ephemeral Access Configuration (%s). |
01b70064 | Special characters (%s) should only include these characters %s for Ephemeral Access Configuration (%s). |
01b70065 | The special characters (%s) in the password have a duplicate character (%c) for Ephemeral Access Configuration (%s). |
01b70066 | The number of special characters in the password (%u) is less than the minimum number required (%u) for Ephemeral Access Configuration (%s). |
01b70067 | Ephemeral Authentication cannot be empty in Ephemeral Access Configuration (%s). |
01b70068 | The %s (%s) associated with %s (%s) is not a valid %s. |
01b70069 | User LDAP DN session variable is required in Ephemeral Access Configuration (%s) because LDAP is enabled in %s. |
01b7006a | If using Single Sign-On (%s), you can select only one authentication method for ephemeral authentication (%s). |
01b7006b | TCP profile must be present on both client-side and server-side of virtual server (%s) when LDAP Auth profile is attached. |
01b7006c | Proxy user DN is mandatory in LDAP Auth profile (%s). |
01b7006d | Proxy user password is mandatory in LDAP Auth profile (%s). |
01b7006e | Ephemeral Access Configuration cannot be empty in virtual server (%s) when LDAP Auth profile is attached. |
01b7006f | Pool configuration is mandatory in virtual server (%s) when LDAP Auth profile is attached. |
01b70070 | User DN (%s) should not be present in both bypass user list and deny user list in LDAP Auth profile (%s). |
01b70071 | Profile (%s) should not be attached to virtual server (%s) when LDAP Auth profile is attached. |
01b70072 | LDAP Auth base profile (%s) cannot be modified. |
01b70073 | LDAP Auth base profile (%s) cannot be attached to virtual server (%s). |
01b7007c | Host group is mandatory for a host group entry in RADIUS Client (%s). |
01b7007e | Privilege level (%d) is invalid for vendor (%s) in RADIUS Client (%s): Host group (%s). Allowed levels: %s |
01b70083 | Portal Access resource(%s) should have Ephemeral Authentication flag enabled as Ephemeral access config(%s) is supplied for Virtual Server(%s) |
01b70084 | Webtop link(%s) should have Ephemeral Authentication flag enabled as Ephemeral access config(%s) is supplied for Virtual Server(%s) |
01b70085 | Samesite cookie value changed in %s. Enable it for change to take effect. |
01b70086 | SSH Security Configuration (%s) is system built-in. Cannot modify/delete it. |
01b70087 | The cipher (%s) is already in use by SSH Security Configuration (%s). |
01b70088 | The key exchange (%s) is already in use by SSH Security Configuration (%s). |
01b70089 | The hmac (%s) is already in use by SSH Security Configuration (%s). |
01b70090 | The compression (%s) is already in use by SSH Security Configuration (%s). |
01b70091 | SSH Security Configuration (%s) must contain at least one cipher entry. |
01b70092 | SSH Security Configuration (%s) must contain at least one key exchange method entry. |
01b70093 | SSH Security Configuration (%s) must contain at least one hmac entry. |
01b70094 | SSH Security Configuration (%s) must contain at least one compression entry. |
01b70095 | SSH Security Configuration (%s) requires at least one cipher entry. Cannot delete cipher (%s). |
01b70096 | SSH Security Configuration (%s) requires at least one key exchange entry. Cannot delete key exchange method (%s). |
01b70097 | SSH Security Configuration (%s) requires at least one hmac entry. Cannot delete hmac (%s). |
01b70098 | SSH Security Configuration (%s) requires at least one compression entry. Cannot delete compression (%s). |
01b70099 | SSH Security Configuration must be specified in Ephemeral Access Configuration (%s). |
01b70100 | The SSH Security Configuration (%s) associated with Ephemeral Access Configuration (%s) does not exist. |
01b70101 | The compression algorithm (%s) cannot be used along with the existing compression algorithms (%s) for SSH Security Configuration (%s). |
01b90001 | AJAX encryption or both AJAX integrity and strong integrity must be enabled for URL '%s' while parameter '%s' has AJAX mapping enabled in the Anti-Fraud profile '%s'. |
01b90001 | Security FlowSpec: %s: route domain (%s) is already used by %s. |
01b90005 | %s: The number of custom signatures (%d) is over limit (%d). |
01b90006 | Dos signature %s: '%s' is not applicable for %s and should be kept as the default value, '%s'. |
01b90007 | Dos signature %s: '%s' is not allowed to be modified %s. |
01b90008 | Dos profile %s: cannot be deleted because %s. |
01b90009 | %s: The associated custom signature (%s) is not a custom Dos persistent signature. |
01b9000a | %s: shareability-state cannot be changed to not-shareable because it is referred by %s. |
01b9000b | %s: The associated custom signature (%s) is not a shareable or doesn't have matching parent-profile. |
01b9000c | %s: The associated custom signature (%s) only can be referred by %s. |
01b9000d | Dos signature %s: The signature's partition (%s) doesn't match its '%s' partition (%s). |
01b90014 | Cannot edit response page %s while its type is Default. |
01b9001c | Bot signature category %s not found. |
01b9001d | Bot defense profile (%s) class override (%s) error: %s. |
01b9001e | Bot Defense Profile (%s) Micro Service (%s): %s. |
01b9001f | Bot Defense Profile (%s) Micro Service (%s) Url (%s): %s. |
01b90020 | Bot defense profile (%s) anomaly override (%s): %s. |
01b90021 | Bot defense profile (%s) Signature (%s) should be Mobile Application Class signature. |
01b90022 | Bot defense signature category illegal class (%s). |
01b90023 | Bot defense profile (%s) signature category override not supported for (%s) which belongs to (%s) class. |
01b90024 | Bot defense profile (%s) signature override not supported for (%s) which belongs to (%s) class. |
01b90025 | Bot defense profile (%s) Micro Service (%s) class override (%s) error: %s. |
01b90026 | Bot defense profile (%s) error: %s. |
01b90027 | Only one place directive may be specified for firewall rule (%s) per transaction. |
01b90028 | Internal error #%u in firewall rule ordering |
01b90029 | There is a loop in firewall rule ordering specified with place_before and place_after options in the following rules: %s |
01b9002b | Inconsistency in Anti-Fraud log profile: %s. |
01b9002c | Security FlowSpec: %s: %s is not user settable field. |
01b9002d | Security FlowSpec: %s: %s are mutual exclusive fields. They cannot be specified simultaneously. |
01b9002e | Security FlowSpec: %s: 'expiry-time' (%s) is invalid. It is earlier than current time (%s). |
01b9002f | Security FlowSpec: %s: The rule can not be created since the sum of current system advertised flowspec routes (%d) and user defined routes in database (%d) would exceed the max flowpsec route limit (%d) as per profile (%s) configuration. |
01b90030 | Security FlowSpec: %s: The value (%d) for %s is outside the acceptable value set [range %d - %d (inclusive)]. |
01b90031 | Security FlowSpec: %s: %s must be configured when %s is redirect. |
01b90032 | Security FlowSpec: %s: %s (%s) and %s (%s) must be the same type (IPv4 or IPv6). |
01b90033 | Security FlowSpec: %s: For port range, beginning port (%d) can not be greater than end port (%d). |
01b90034 | Security FlowSpec: %s: The rule can not be created or changed to persisted one since total number of persisted rules in MCP database (%d) would exceed the max allowed in database limit (%d) as per profile (%s) configuration. |
01b90035 | %s cannot be changed to %s because the number of persisted rules of profile %s in MCP database is already %d. |
01b90036 | Security FlowSpec: %s: can not refer %s which is neither in the same partition as profile nor in /Common partition. |
01b90037 | Blacklist Publisher Profile (%s): %s is invalid. |
01b90038 | Security FlowSpec: %s: port argument is not allowed for non-port-based protocol (%d). |
01b90039 | Security FlowSpec: %s: The protocol (%d) is not supported. |
01b9003a | Security FlowSpec: %s: The max flowspec route limit can not be decreased since the sum of current system advertised flowspec routes and user defined routes in database (%d) would exceed the specified max flowpsec route limit (%d). |
01b9003b | Security FlowSpec: %s: IP fragement can't be specified with IPv6 Flowspec rule (%s). |
01b9003c | Multiple extension header types defined in policy %s, rule %s. Only one extension header type per rule supported. |
01b9003d | Extension header type %s used more than once in policy %s. Extension header type that doesn't support additional values can be used only once per policy. |
01b9003e | Value %u associated with extension header type %s used more than once in policy %s. Any (Extension header type, value) pair can be used only once per policy. |
01b9003f | Specifying values for extension header type %s is not supported, but values specified in policy %s, rule %s. |
01b90040 | Aggregate log rate for security packet filter cannot be greater than %u. |
01b90045 | Firewall Zone configuration %s exceeds maximum allowed limit of %d. |
01b90047 | %s: %s is not supported. |
01b90048 | %s: Configuration cannot be modified because %s. |
01b90049 | The %s (%s) for %s (%s) has the incorrect number of 0-bits set for the given address/prefixlen. |
01b9004a | Inconsistency in Anti-Fraud log profile: %s. |
01b9004b | Inconsistency in the Anti-Fraud DOM signature '%s'(hash ID): %s in the Anti-Fraud profile '%s'. |
01b9004c | Log publisher '%s' used by Anti-Fraud log profile '%s' can have only Remote HSL, Splunk or Syslog destinations. |
01b9004d | Anti-Fraud parameter '%s' is invalid. Enabling CSS selector for parameter requires: 1. either Full AJAX encryption or AJAX integrity enabled 2. parameter type is explicit in the Anti-Fraud profile '%s' (Anti-Fraud URL: '%s'). |
01b9004e | No other maximum length can be greater than maximum request length (%u) in HTTP Security profile '%s'. |
01b90050 | (%s, %s) %s (%s) must have match type (%s) to enable %s. |
01b90055 | Dos Signature (%s): %s can be %s when %s is %s. |
01b90056 | %s (%s): %s must set to %s when %s is set. |
01b90062 | Specified next hop vlan '%s' for NAT policy '%s' rule '%s' has a different route domain(%d) than currently configured route domain(%d) in destination address (%s). |
01b90063 | Unable to create source-translation object %s as EIF timeout can be set only if inbound-mode is endpoint-independent-filtering. |
01b90065 | Modifying dos.icmp6msgtype1 not supported on Smartnic devices. |
01b90066 | Modifying dos.icmp6msgtype2 not supported on Smartnic devices. |
01b90067 | Modifying dos.tcp.allow.unknown.opt1 not supported on Smartnic devices. |
01b90068 | Modifying dos.tcp.allow.unknown.opt2 not supported on Smartnic devices. |
01bb0001 | Route domain configuration error: %s |
01bb0002 | %s - sadc |
01bb0005 | Raising ICMP monitor priority is not supported on this platform (%s). |
01bb0006 | ICMP monitor priority feature not supported in vCMP mode. |
01bf0004 | Creating/Modifying Protocol Inspection compliance map are not allowed. |
01bf0005 | Deleting Protocol Inspection compliance map are not allowed. |
01bf0006 | Dependency failed between Protocol Inspection profile %s and the profile %s for the virtual %s, \'%s\' field must be enabled for %s |
01bf0007 | Creating/Modifying Protocol Inspection service config object is not allowed. |
01bf0008 | Deleting Protocol Inspection compliance service config is not allowed. |
01bf0009 | Creating/Modifying Protocol Inspection service config map is not allowed. |
01bf0010 | Deleting Protocol Inspection service config map is not allowed. |
01bf0011 | Deleting Protocol Inspection service config enums is not allowed. |
01bf0012 | Creating/Modifying Protocol Inspection service config enums is not allowed. |
01bf0013 | Creating/Modifying predefined Protocol Inspection common-config meta objects is not allowed. |
01bf0014 | Deleting predefined Protocol Inspection common-config meta objects is not allowed. |
01bf0015 | Creating/Modifying predefined Protocol Inspection common-config compliances is not allowed. |
01bf0016 | Deleting predefined Protocol Inspection common-config compliances is not allowed. |
01bf0017 | Creating/Modifying predefined Protocol Inspection common-config service configs is not allowed. |
01bf0018 | Deleting predefined Protocol Inspection common-config service configs is not allowed. |
01bf0019 | Protocol Inspection service config %s requires valid value: %s |
01bf0020 | Protocol Inspection common-config is not defined. |
01bf0021 | Mismatch for service config(%s) and compliance/signature service version(%s) |
01c00001 | Please modify the addresses of cluster members only through the cluster component. |
01c80025 | CONNECTOR: L7 get protocol failed |
01c80026 | CONNECTOR: L7 get protocol wrong type %d |
01c80027 | CONNECTOR: Cannot allocate memory for %s |
01c80028 | CONNECTOR: Create and insert node for connflow %F, proxy %s, listener %s, profile %s |
01c80029 | CONNECTOR: Error creating node for connflow %F, proxy %s, profile %s [%s] |
01c80030 | CONNECTOR: Send Perform-Method to connector %s, method-id %u |
01c80031 | CONNECTOR: Teardown/abort connector %s, profile %s, message %s |
01c80032 | CONNECTOR: Listener %s, profile %s connect to service entry virtual server %s |
01c80033 | CONNECTOR: Listener %s, profile %s service %s entry ingress, ingress bytes %u |
01c80033 | CONNECTOR: Listener %s, profile %s, service connection result %u |
01c80034 | CONNECTOR: Listener %s, profile %s connected to service entry virtual server %s |
01c80035 | CONNECTOR: Listener %s, profile %s initialize connection |
01c80036 | CONNECTOR: Listener %s, profile %s service returned bytes %u |
01c80036 | CONNECTOR: Uninitialize service connection |
01c80037 | CONNECTOR: Listener %s, profile %s, state %s, process message %s |
01c80038 | CONNECTOR: Listener %s, profile %s enqueue service connect to %s |
01c80039 | CONNECTOR: Listener %s, profile %s dequeue service connect [hold=%s ingress-len=%u] |
01c80040 | CONNECTOR: State %s event %s [external event %s] |
01c80040 | CONNECTOR: Listener %s, profile %s dequeue service connect [error=%u] |
01c80041 | CONNECTOR: Listener %s, profile %s forward events [%s%s%s] to service %s |
01c80042 | CONNECTOR: encountered error: %E File: %s Function: %s, Line: %d |
01c90000 | MR MQTT: %s returned error: %lE |
01c90002 | MR MQTT: Keepalive timeout resulted in connection close. |
01c90003 | MR MQTT: Broker connection being reused. |
01c90004 | MR MQTT: Parser error (%E), connection will be closed. |
01c90005 | MR MQTT: Ingress buffer full, closing TCP window (flow %F) |
01c90006 | MR MQTT: Ingress buffer draining, opening TCP window (flow %F) |
01cb0029 | Error: signature generation fails for '%s'. |
01cb0030 | Error: signatures rotation fails for '%s'. |
01cc0000 | Config error: Agent Rate Limiting Config Entry [%s:%d] update: agent clone failed |
01cc0000 | NATS server returned error: '%.*s' |
01cc0000 | Peer (%s) delay %d ms %s the %s threshold %d ms |
01cc0001 | The number of messages sent to the peer (%s) %d msgs/sec %s the %s rate limit threshold %d msgs/sec |
01cc0002 | The number of messages from the peer (%s) %d msgs/sec %s the %s rate limit threshold %d msgs/sec |
01cc0003 | Peer (%s) errors percentage %d %s the %s threshold %d percentage |
01cc0004 | Peer (%s) timeouts percentage %d %s the %s threshold %d percentage |
01cc0006 | Peer (%s) connection state has changed: %s |
01cc0008 | telemd setrlimit %d error: %s %ld. |
01d40003 | Geo_Redundancy: Reload failed: %s (%E) |
01d40004 | Geo_Redundancy: Session DB update failed: %E |
01d40007 | Geo_Redundancy: Message dropped, %s, %E |
01d40008 | Geo_Redundancy: Unknown GEO message received, %d |
01d40009 | Geo_Redundancy: Can't send message, %s, %d |
01d4000a | Geo_Redundancy: unexpectedly disconnected %s |
01d4000b | Geo_Redundancy: status set to offline |
01d4000c | Geo_Redundancy: status set to connected |
01d4000d | Geo_Redundancy: status set to reload sending |
01d4000e | Geo_Redundancy: status set to reload receiving |
01d40010 | Geo_Redundancy: watchdog has expired |
01d40028 | Error: LogIntegrity run is prohibited from '%s'. |
01d70002 | Warn: %s |
01d70002 | %s |
01d70003 | Info: %s |
01d70004 | MR_RATELIMIT: message id %s dropped on %s |
01d70004 | Error '%s' opening pid file '%s'. |
01d70006 | Fork failed: %s |
01d70007 | Error '%s' attempting to chdir to '%s' |
01d70008 | Error '%s' opening file %s |
01d70010 | Error '%s' sending signal '%d' to process '%d'. |
01d70011 | Insufficient memory, allocation failed. |
01d70012 | Error dispatching event |
01d70013 | Initial subscription for system configuration failed with error '%s' |
01d70014 | Unexpected tag '%s' in msg |
01d70016 | No more space to add MCP tag. |
01d70017 | Add MCP tag after compacted. |
01d70018 | No more space to add MCP object. |
01d70019 | MCP tags already compacted. |
01d70020 | MCP objects already compacted. |
01d70021 | No more space to compact MCP objects. |
01d70024 | Error calling setsockopt on mcp fd: '%s'. |
01d70025 | Connection to mcpd failed with error '%s' |
01d70026 | Cannot find tag '%s' in message |
01d70027 | %s %s %s |
01d70029 | %s %s %s |
01d70030 | %s: Unexpected tag '%s' in msg |
01d70031 | Error fetching disk space |
01d70032 | Unable to fetch disk space : %s |
01d70033 | Disk usage at \\var\\log: %d%%, Configured threshold %d%% |
05000017 | Attr(%attr/%s) is unknown under (%parent/%s) |
05000018 | client(%client/%s) last response code(%responsecode/%s) result(%result/%d)(%resultmsg/%s) request_id(%requestid/%d) |
05000019 | client(%client/%s) last request code(%requestcode/%s) request_id(%requestid/%d) |
0501001e | Failed to call sem_post. ctx(%context/%s) client(%client/%s) Error: (%error/%d)((%strerr/%s)) |
05010022 | message-post failure(%failure/%s) from (%user/%s) |
05010023 | Internal pipe operation (%op/%s) failed client(%client/%s) ((%errno/%d)/(%sterrror/%s)) bytes (%expect/%d)/(%done/%d) |
05010024 | Session inactive for (%user/%s) failed (%ctx/%s) |
05020039 | Expect only one busy block, as min-upd > config-switch (%count/%d) (%sequences/%s) |
05020061 | Failed to init ha |
05020062 | Failed to exit ha |
05020063 | Failed to send heartbeat to update ha |
05020065 | Cannot find PM(%pm/%s) for status update for VIP(%vip/%s) |
05020067 | Unhandled message(%msg/%s) reason(%reason/%s) |
05020068 | stats reset failed (%reason/%s) |
05020069 | SNAT detected for pm(%pm/%s) when DSR mode is enabled on vip(%vip/%s) |
0503000a | Class (%class/%s) was not requested |
0503000b | Hornet response error (%error/%d) (%msg/%s) |
0503000c | Neuron rule programming failure. Operation: (%op/%s) Rule Text: (%text/%s) Error: (%error/%s) |
05030011 | nexthop update failed with err ((%err/%s)) |
05030012 | vlan update failed with err ((%err/%s)) |
05030013 | virtual update failed with err ((%err/%s)) |
05030014 | Pool-member update failed with err ((%err/%s)) |
05030015 | Self-IP update failed with err ((%err/%s)) |
05030016 | SNAT-pool-member update failed with err ((%err/%s)) |
Log Messages Details
00020000 : Resuming log processing at this invocation; held %d messages.
Location:
/var/log/ltm
Conditions:
The following messages are not the actual log messages.
00020000:6: Re-enabling general logging; held %d messages
00020000:6: Cumulative log rate exceeded! Throttling all non-debug logs.
You should locate the unthrottled versions, which will look like one of the following:
00020000:6: Developer error: unrecognised logging variable '$vname'!
00020000:6: Developer error: unrecognised logging domain in '$prodsub'!
It would also help to have the name of the process that logged the message.
These messages occur when a feature tries to log, read, or write a control flag for a logging product or subset that does not exist (the initial four digits of a log number). It is also possible that these logs are being generated by code that is attempting to map command line options, GUI elements, db variables, etc., to log control variables.
Impact:
If these messages are coming from a feature, that feature is not successfully logging. If these messages are coming from some kind of bridge between command line options, GUI elements, db variables, or log control variables, then the knob or control does not work.
Recommended Action:
If these messages are the result of a miscoded feature, then the feature has never been able to send logs, and there is no work-around for the problem.
If these messages are the result of a miscoded control knob (command line option, GUI element, db variable, etc.), then that control knob will not work, but the associated logs can still be controlled via Common Logging Framework objects (Publishers, Destinations, and Filters).
In either case, please file a bug.
01010001 : %s starting
Location:
/var/log/ltm
Conditions:
Example:
01010001:5: pgo_use x86_64 padc TMM Version 13.0.0.0.0.1622 starting
The message is emitted at 'notice' priority, and is an announcement that the given TMM instance has started. It is always emitted, and provides the target, architecture, and build version for the TMM executable.
Impact:
The appearance of this message indicates system health. Its presence is useful for locating the point in the logs where TMM instances start.
Recommended Action:
None.
01010004 : Memory allocation failed: %s
Location:
/var/log/ltm
Conditions:
This error occurs when there is not enough free memory left in the system to allocate the required amount for a software module.
Impact:
The impact could range from some of the functionality being briefly delayed until more memory becomes available to a significantly more damaging issue, such as the system failing to allocate memory for new connections, causing the system to become unusable.
Recommended Action:
If possible, provision more memory to TMM.
Use 'top -a' or 'ps v | sort -k 8 -g -r | head' to look for processes occupying excessively large amounts of memory. Consider restarting said process(es), saving the core(s), and filing a bug.
01010007 : "Config error: %s"
Location:
/var/log/ltm
Conditions:
The following configuration error messages point to a failure in setting up internal services necessary for the Network Access feature in APM to work.
- Config error: Access forwarding virtual create failed.
- Config error: Access HTTP forwarding virtual create failed.
The following configuration error message points to a failure in setting up internal services necessary for the Portal Access feature in APM to work.
- Config error: Access portal virtual create failed.
Impact:
Network Access feature in APM will not work.
- Config error: Access forwarding virtual create failed.
- Config error: Access HTTP forwarding virtual create failed.
Portal Access feature in APM will not work.
- Config error: Access portal virtual create failed.
Recommended Action:
This issue might be a result of invalid configuration. Please reload configuration using 'tmsh load sys config'. The output of config reload should be without error.
01010011 : Persistence cookie hash failed
Location:
/var/log/ltm
Conditions:
This error can occur when, for a given persistence profile, a cookie hash entry (in the profile's persistence table) is either invalid or becomes stale, compared to the expected HTTP cookie header in the server side response from a pool member requiring persisted connections. The length of the HTTP cookie header probably exceeds the offset of the cookie hash specified in the persistence profile.
Impact:
This error indicates an invalid cookie hash persistence entry and, as a result, connections might not be persisted for the expected pool or pool members. Instead the default load-balancing method is applied.
Recommended Action:
Either of the following actions can help to solve the problem:
1. Correct the cookie hash entry in the persistence profile, by changing the cookie hash offset or length, to accommodate the HTTP cookie in the server side response for the correct parsing of the cookie hash.
2. Change the HTTP cookie header in the server side response, on the pool member requiring persistent connections, to accommodate the expected cookie hash in the related persistence profile.
01010013 : database size increased by %d bytes, %d total
Location:
/var/log/ltm
Conditions:
This message is an informative message that is logged when the BIG-IP configuration database needs to be extended. It does not necessarily reflect an error.
Impact:
None.
Recommended Action:
None.
01010019 : Caught signal %d, exiting
Location:
/var/log/ltm
Conditions:
Example:
01010019:5: Caught signal 2, exiting
The message is emitted at 'notice' priority, and is an announcement that the TMM has received either a SIGINT (2) or a SIGKILL (15) signal. The most common way to send TMM one of these signals is with the 'kill' command from the BIG-IP device's root shell.
The 'kill' command requires the process identifier ("pid") for the targeted executable. To find the list of pids for TMM, from the root shell, enter the following command:
cat /var/run/tmm.*.pid | sort -un
On a running BIG-IP system, one or two pids will be displayed. Choose either pid, substituting the number into the command "kill -INT ____". For example:
[root@bigip:Active:Standalone] log # cat /var/run/tmm.*.pid | sort -un
20050
[root@bigip:Active:Standalone] log # kill -INT 20050
[root@bigip:Active:Standalone] log # Jan 26 16:12:14 bigip emerg logger: Re-starting tmm
Jan 26 16:12:14 bigip emerg logger: Re-starting tmm1
Jan 26 16:12:14 bigip emerg logger: Re-starting tmm2
Jan 26 16:12:14 bigip emerg logger: Re-starting tmm3
Jan 26 16:12:14 bigip emerg logger: Re-starting tmm4
Jan 26 16:12:14 bigip emerg logger: Re-starting tmm5
Jan 26 16:12:14 bigip emerg logger: Re-starting tmm6
Jan 26 16:12:15 bigip emerg logger: Re-starting tmm7
# grep 01010019 /var/log/ltm
Jan 26 16:12:13 bigip notice tmm[20050]: 01010019:5: Caught signal 2, exiting
Impact:
When a TMM process instance receives a SIGINT or SIGKILL signal, all TMM instances are restarted immediately. No core file is produced. On systems where multiple TMM processes are running, tmm.start will detect the termination of any of its child TMM process instances and display the following message:
notice tmm.start: /etc/bigstart/scripts/tmm.start caught SIGCHILD, sending SIGTERM to all remaining tmms
This assures that if any TMM process is terminated for any reason, all TMM processes are restarted.
Recommended Action:
It is abnormal for SIGINT or SIGKILL to be sent to a process. If this message is seen in the logs, it indicates that a TMM process received the indicated signal. F5 Networks is not aware of any way this can occur, other than through the action of a root user at the bash shell prompt. Blocking access to the root ("Advanced") shell, or selecting Appliance Mode in the BIG-IP license should eliminate the possibility of seeing this message.
01010020 : MCP Connection %s, exiting
Location:
/var/log/ltm
Conditions:
MCP connection is closed, aborted, or expired after tmm saw any data coming from mcp. It might happen due to any connectivity problems between tmm and mcp or mcp being down.
Impact:
It is a critical error for TMM. It restarts. Attempts to reconnect will be made after that.
Recommended Action:
Verify that mcpd is up, and consider restarting it. Inspect /var/log/ltm to find mcpd messages pointing to the reason of failure.
01010027 : Unable to attach to PCI device %02x:%02x.%02x
Location:
/var/log/ltm
Conditions:
At startup, tmm attaches to several hardware acceleration devices (network devices such as kernel interfaces, HSB DMA engines, ssl crypto, and compression devices). Any failure to initialize a device results in the 'Unable to attach' with the specific PCI bus:slot.func coordinates.
Impact:
Device will not be used by tmm and could impact traffic passing, or result in fallback to software compression or crypto.
Recommended Action:
Restart tmm. System reboot. Potential RMA.
01010028 : No members available for pool %s
Location:
/var/log/ltm
Conditions:
The probable cause for this message is external to the BIG-IP system: the pool members (servers) are all either down or unreachable. Additionally, this message could also be caused by a hardware or software issue on the BIG-IP itself.
Impact:
Services that require access to members of the given pool log errors and cease to function.
Recommended Action:
Find and correct the server access problem following typical server connectivity debugging processes.
01010029 : Clock advanced by %u ticks
Location:
/var/log/ltm
Conditions:
This message will be logged if the tmm clock is modified by more than 100 ticks at once after tmm is ready. This could indicate a situation where the TMM might be preempted or has a lagging clock, or an NTP message was received with a large difference in time.
Impact:
The tmm common ticks which affects flow timeouts, TCP timestamps etc will be abruptly incremented.
Recommended Action:
After ensuring that the time/NTP server is correctly set on the blade(s) and chassis, reboot the BIG-IP once to ensure that the tmms are correctly synchronized to the NTP time.
01010038 : Syncookie counter %d exceeded vip threshold %u for virtual = %A:%d
Location:
/var/log/ltm
Conditions:
A virtual server is under high load such that the outstanding SYN cookie threshold is reached. The threshold is configured with the default-vs-syn-challenge-threshold LTM global-settings connection property.
Impact:
While the per-virtual server SYN cookie threshold is reached, SYN cookies will not be issued on the virtual server. Connections will be established without SYN cookies.
Recommended Action:
Investigate whether the traffic load is normal or excessive. The SYN cookie threshold might be reached due to a normal spike in traffic or an attack.
01010040 : Clock has unexpectedly adjusted by %lld ms
Location:
/var/log/ltm
Conditions:
Internal TMM clock adjustment occurred.
Impact:
TMM might be unable to converge on an accurate representation of its internal time. TMM clock has been advanced by more ticks than expected. This can indicate that TMM has been preempted or has a lagging clock.
Recommended Action:
If this message occurs routinely, contact support.
01010044 : "%s feature %s licensed"
Location:
/var/log/ltm
Conditions:
This message does not necessarily denote a problem. It displays the license status of BIG-IP device's component.
When status for component X is "licensed", this log displays the message:
Component X is licensed.
When the component is not licensed, the message is:
Component X is NOT licensed.
Impact:
If the message is "Component X is licensed", there is no impact. It is an informative message.
If the message is "Component X is not licensed", then you cannot use the mentioned component/feature.
Recommended Action:
If you want to use a component that is not currently licensed, you need to activate the license.
01010045 : Bandwidth utilization is %d Mbps, exceeded %d%% of Licensed %d Mbps
Location:
/var/log/ltm
Conditions:
This message appears when the system is using more bandwidth that it was licensed to use.
Impact:
The system will not perform at its full potential with a limited license.
Recommended Action:
A license with better bandwidth utilization would stop this message from appearing.
01010054 : tmrouted connection %s
Location:
/var/log/ltm
Conditions:
The connection between the tmrouted daemon and TMM has been lost.
Impact:
This is expected behavior during shutdown or restart. If it occurs during normal operation examine system log files for indications as to the behavior of the tmrouted daemon, which likely restarted. If the tmrouted deamon restarts, dynamic routing will be interrupted.
Recommended Action:
Look for tmrouted corefiles and tmrouted log messages in /var/log/ltm.
01010056 : Syncookie counter %d exceeded vip threshold %u for virtual = %s
Location:
/var/log/ltm
Conditions:
A virtual server configured with traffic-matching-profile is under high load such that the outstanding SYN cookie threshold is reached. The threshold is configured with the default-vs-syn-challenge-threshold LTM global-settings connection property.
Impact:
While the per-virtual server SYN cookie threshold is reached, SYN cookies will not be issued on the virtual server. Connections will be established without SYN cookies.
Recommended Action:
Investigate whether the traffic load is normal or excessive. The SYN cookie threshold might be reached due to a normal spike in traffic or an attack.
01010201 : Inet port exhaustion on %*A to %*A%c%d (proto %d)
Location:
/var/log/ltm
Conditions:
This error appears on a system when an unused ephemeral port cannot be found by using the ephemeral port search criteria. Variables specify the lost IP address and port connection due to this condition. The search criteria defaults to 16 random attempts, with 16 linear attempts. A single IP address can choose from about 64k ports, so not finding a port indicates that the system is using over 60k ports. The exact number of ports in use is unknown, because the algorithm discovers open ephemeral ports through a methodology, instead of counting ports. The results of the algorithm are approximately 64k ports.
Impact:
When this error occurs, the port-find functionality fails and the connection is lost.
Recommended Action:
There is no workaround for this error. The algorithm stops when this error is written to /var/log/ltm. To mitigate this condition, a warning message is available in BIG-IP version 12.0, indicating that the port-find functionality is heavily loaded (statistically 80% to 90% of the 64k ports in use). You can use an SNMP trap to alert this message, and inform the client to add more virtual IP's the system, relieving the heavily loaded connections.
01010213 : L3 Address LB method deprecated; using 'Least Connections' for pool %s
Location:
/var/log/ltm
Conditions:
A virtual server is configured with L3 Address load balancing method.
Impact:
The Least Connections load balancing method will be used instead of the deprecated L3 ADDR load balancing method.
Recommended Action:
Set the virtual server load balancing method to Least Connections. or other desired load balancing method.
01010216 : DNSSEC: Signature failed (%s) for RRSET (%s, %lu) with key %s, generation %llu.
Location:
/var/log/ltm
Conditions:
Unable to sign RRSet. See error for more details. Typically this is due to the device running out of memory, but could also be due to the device experiencing a heavier than usual load.
Impact:
RRSet will not be signed.
Recommended Action:
If this is memory related, use the command 'top -a' or 'ps v | sort -k 8 -g -r | head' to look for processes occupying excessively large amounts of memory. Consider restarting said process(es), saving the core(s), and filing a bug.
01010221 : Pool %s now has available members
Location:
/var/log/ltm
Conditions:
A pool with no available members now has available members. The pool may have had no available members due to administrative action, monitors, connection limits, or other constraints on pool member selection.
Impact:
This indicates that traffic is now load-balanced to the available member as desired.
Recommended Action:
None.
01010225 : Failure to query dns-express db (%s)
Location:
/var/log/ltm
Conditions:
This log messages covers a variety of errors that indicate a query to the DNS Express database was not successful. The possible reasons include the database not being readable and malformed queries.
Impact:
Generally, a query in this situation will continue to be processed according to the DNS Profile configuration. An AXFR request to the BIG-IP will result in either a SERVFAIL or FORMERR response to the requesting client.
Recommended Action:
This message should be used in conjunction with other log messages to determine impact to the system.
01010231 : DNSSEC: Did not add RRSIGs to response RR set (owner: %s).
Location:
/var/log/ltm
Conditions:
Tmm has detected that it should have signed a dns response with a dnssec key but didn't add a resource record signature.
Impact:
The current dns response will be dropped.
Recommended Action:
The message indicates a problem signing a resource record using a dnssec key. Other log messages might indicate why a particular key failed to sign the resource record, and should be investigated to verify that the information associated with the dnssec keys is correct.
01010235 : Inet port find called for pg %d with invalid cmp state %x
Location:
It can happen when current TMM's CMP state is invalid or the target TMM is down.
Conditions:
This error message appears when a TMM runs port find for a target TMM that is not active based on current CMP state. A TMM in BIGIP is identified as {PG, PU}. PG refers to slot index and PU refers to TMM index on the slot. This error message complains the PG of the target TMM is down based on current CMP state.
Impact:
It might cause flow connections to fail.
Recommended Action:
No workaround. Reboot if the problem persists.
01010239 : LSN error: %s
Location:
LTM log
Conditions:
An LSN pool is configured, but the CGNAT module is not licensed and provisioned.
Impact:
The CGNAT configuration is ignored by TMM until the CGNAT module is licensed and provisioned. No other negative impacts.
Recommended Action:
License and provision the CGNAT module.
01010240 : Syncookie HW mode activated, server = %A:%d, HSB modId = %d
Location:
/var/log/ltm
Conditions:
This message indicates that the BIG-IP device has detected a syncookie DOS attack and activated hardware syncookie protection mode on the HSB.
Impact:
This is an information message regarding hardware syncookie protection state on the BIG-IP device. it does not indicate any operation error. Refer to https://support.f5.com/csp/article/K14813 for more information on detecting and mitigating DoS/DDoS attacks.
Recommended Action:
None.
01010241 : Syncookie HW mode exited, server = %A:%d, HSB modId = %d from %s
Location:
/var/log/ltm
Conditions:
When HSB exits hardware syncookie protection mode on the BIG-IP device. It indicates that the BIG-IP device detects that the syncookie DOS attack has stopped.
Impact:
This is an information message regrading hardware syncookie protection state on the BIG-IP device. It is not an error message. Refer to https://support.f5.com/csp/article/K14813 for more information on detecting and mitigating DoS/DDoS attacks.
Recommended Action:
None.
01010250 : Pool member %A:%u exceeded configured rate limit.
Location:
/var/log/ltm
Conditions:
If this message appears, the configured number of allowed new connections per second for pool member has been exceeded.
Impact:
New connections for pool member are created faster than allowed in configuration. The BIG-IP device prevented an excessive number of connection requests to this pool member. Connections still might have been established after a retry to the other pool member.
This might indicate that the pool member is a target for more connections than it was configured to handle. If all pool members report this problem at the same time, the virtual server might be experiencing a high-demand traffic event or be under Denial of Service (DoS) attack.
Recommended Action:
Rate limit can be changed as described in Manual: Setting Connection Limits (https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-11-2-1/30.html).
01010251 : Virtual %s exceeded configured rate limit.
Location:
/var/log/ltm
Conditions:
If this message appears, the configured number of allowed new connections per second for virtual server has been exceeded.
Impact:
New connections for virtual server are created faster than allowed in configuration. Thus, the BIG-IP device prevented an excessive number of connection requests. This might indicate that virtual server is during high-demand traffic event or under Denial of Service (DoS) attack.
Recommended Action:
Rate limit can be changed as described in Manual: Setting Connection Limits (https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-11-2-1/30.html).
01010259 : External Datagroup (%s) %s.
Location:
/var/log/tmm.x, where x indicates the tmm thread number.
Conditions:
All variants of the message are related to operations on externals datagroups (see ttps://devcentral.f5.com/articles/the101-irules-101-datagroups-amp-tables ). These operations are conducted by an administrator through a configuration interface (web GUI, tmsh CLI, or by script) and include datagroup creation, update, and deletion.
- "queued" and "queued for update": This is not an error. The message indicates that tmm started processing external datagroup file (for datagroup creation or update, respectively).
- "creation finished" and "update finished": This is not an error. The message indicates that tmm successfully finished processing external datagroup file (for datagroup creation or update, respectively).
- "deleted": This is not an error. The message indicates that processing of external datagroup file was cancelled, because datagroup was deleted.
- "failed": Processing of external datagroup file failed. Either tmm is out of memory or a TCL error occurred.
Impact:
Only a "failed" message indicates an error: An external datagroup was not created nor updated (depending on operation requested).
Recommended Action:
For a "failed" message: Check for excessive memory usage using 'ps aux --sort -rss | head'. Consider restarting the processes consuming too much memory. If there is no excessive memory usage, file a bug. Try re-issuing datagroup operation.
01010260 : Hardware Error(%s): %s %s
Location:
/var/log/tmm.n, where n is the specific TMM on the BIG-IP that detected the problem.
Conditions:
Occurs when the driver for the Cavium NITROX security co-processor detects a hardware failure.
Impact:
Hardware offloading of SSL traffic will stop and all SSL processing will be done in software. This may result in a performance degradation.
Recommended Action:
Shutdown (power off) the BIG-IP and then restart it. If the problem occurs again, please contact F5 Support for assistance.
01010273 : Access policy Configuration object: [%s] not found
Location:
/var/log/apm
Conditions:
This message will never appear in a good BIG-IP policy configuration environment. This can appear only if an access policy configuration in the BIG-IP system gets corrupted for some reason. The situation it is reporting, when it receives an access policy item modification or deletion (which should have an association with it parent "access policy" object), but could not find its parent "access policy" object.
Impact:
None.
Recommended Action:
Edit the BIG-IP access policy config and remove reported access policy item.
01010274 : Access Policy and Access Policy Item join failed: [%s] not found
Location:
/var/log/apm
Conditions:
This error might appear during a resolve relation between "access policy item" and "access policy". Each access policy has one or more access policy items. At the end of access policy configuration modification process, it is required to resolve all relationships between access policy items within access policy. During this process, if any relationship is broken, mostly due to configuration corruption, it reports this error.
Impact:
There is no direct impact on the system, as it ignores the missing relationship. However, the access policy might not work the way it supposed to, as the reported "access policy item" will not appear in the configuration.
This situation will appear only if the BIG-IP access policy configuration gets corrupted.
Recommended Action:
Edit the access policy and reload.
01010276 : FTPS warning: Security policy disabled for %A%%%u:%u due to explicit FTPS mode negotiation
Location:
/var/log/ltm
Conditions:
When we enter explicit FTPS mode, the ASM profile must be disabled; otherwise, it tries to evaluate encrypted data to make firewall decisions.
Impact:
The configured ASM profile cannot function.
Recommended Action:
Reconfiguration is required. Don't use FTPS with ASM. Refer to the following devcentral article: https://devcentral.f5.com/articles/ftps-offload-via-irules
01010290 : TCP: Memory pressure activated
Location:
/var/log/ltm
Conditions:
TMM has used more memory than the threshold specified in the sys db variable TM.TCPMemoryPressure.lowater (in percent).
Impact:
TCP memory pressure has been reached. TMM might drop payload data or entire packets until memory usage falls below the threshold.
Recommended Action:
Occasionally seeing this message is not necessarily an issue, but might indicate that the TMM needs more available memory. Restarting the TMM might be sufficient to reduce the TMM's memory usage, but the messages are likely to return if the TMM does not have enough memory. Methods to increase the memory available to the TMM include increasing the provisioning level of the LTM module, reducing the amount of traffic directed towards the BIG-IP system, and (on vCMP guests and VE) increasing the memory allocated to the BIG-IP system. TMM memory usage can be observed with the "tmstat" command.
01010291 : TCP: Memory pressure deactivated. Dropped %llu packets, %llu bytes
Location:
/var/log/ltm
Conditions:
TMM was using more memory than the threshold specified in the sys db variable TM.TCPMemoryPressure.lowater (in percent), and memory usage is now below the threshold.
Impact:
TCP memory pressure had been reached, and has now subsided. TMM dropped payload data and/or entire packets as specified in the message.
Recommended Action:
Occasionally seeing this message is not necessarily an issue, but might indicate that the TMM needs more available memory. Restarting the TMM might be sufficient to reduce the TMM's memory usage, but the messages are likely to return if the TMM does not have enough memory. Methods to increase the memory available to the TMM include increasing the provisioning level of the LTM module, reducing the amount of traffic directed towards the BIG-IP system, and upgrading the memory of the BIG-IP system. TMM memory usage can be observed with the "tmstat" command.
01010300 : BDoS: (TMM) Histogram (%p) %s for context %s (ref cnt %d).
Location:
/var/log/bdosd.log
Conditions:
BDoS (dynamic-signature) is enabled/disabled per context.
Impact:
None. This is a log message that displays histogram memory ref count state and is logged only when log.tmm.level is set to level Debug.
Recommended Action:
To disable logging this message, change log.tmm.level to a log level other than Debug.
01010301 : BDoS: (TMM) %s failure for context %s - %s (error %s).
Location:
/var/log/bdosd.log
Conditions:
TMM fails to create BDoS histogram memory for a specific context (device or virtual server) when dynamic-signature feature is enabled on that context. This might happen mainly due to OOM condition.
Impact:
This error message indicates that TMM is unable to enforce the BDoS dynamic-signature feature for the specific context for which the message is logged.
Recommended Action:
None.
01010302 : BDoS: (TMM) %s signature (%s) for context %s at idx %u (detection=%u mitigation=%u state=%s transient=%s retired=%s).
Location:
/var/log/bdosd.log
Conditions:
A new (AFM) BDoS dynamic signature is generated (or an existing signature is updated) by the AFM bdosd daemon during an attack, and the signature create/update message is sent to the tmm daemon for enforcement.
Impact:
None. This is an informational/debug message that is logged only if log.tmm.level is set to level Debug.
Recommended Action:
To disable logging this message, change log.tmm.level to a log level other than Debug.
01010303 : BDoS: (TMM) signature (%s) removed (at idx %u of signature table) from context %s.
Location:
/var/log/bdosd.log
Conditions:
A BDoS dynamic signature is being removed via a remove message received from the bdosd daemon.
Impact:
None. This informational/debug message is logged in TMM only if log.tmm.level is set to level Debug.
Recommended Action:
None.
01010305 : BDoS: (TMM) afm_provisioned=%s dos_provisioned=%s l4_bdos_licensed=%s bdos_feature_enabled=%s detection=%s
Location:
/var/log/bdosd.log
Conditions:
Debug log message that displays AFM/DHD module provision status, as well as l4bdos feature flag license state.
Impact:
None. This is an informational/debug message that is logged whenever if log.tmm.level is set to debug level.
Recommended Action:
None.
01010307 : Memory allocation failed: %s %s
Location:
/var/log/ltm
Conditions:
The message can appear during crypto operations if an allocation request fails to deliver the requested block size.
Impact:
This is an out-of-memory condition. The primary response is to drop the flow associated with the failed allocation request.
Recommended Action:
None.
01010308 : Access Policy update: %s End Txn Failed (%d)
Location:
/var/log/apm, GUI
Conditions:
This error is triggered due to some error in MCPD or in the communication with MCPD. The error represents something observed by a consumer and hence, the source of the error (either in the producer or framework) cannot be ascertained easily.
Impact:
Creation or update of a Per-Request Access policy or its components might not occur.
Recommended Action:
This might be a transient error and might succeed on retry. If this is due to problems in MCPD, restarting MCPD might be necessary.
01010309 : Access Policy(%s) update: Subroutine properties can be only assigned to Access policy of type subroutine
Location:
/var/log/ltm
Conditions:
A subroutine-properties object (tmsh list apm policy subroutine-properties) has been associated with an access-policy object (includes per-request policies and access policy macros) that is not of type subroutine. This is an invalid configuration.
Impact:
This is an invalid configuration. The policy might fail to execute as expected
Recommended Action:
Find the access-policy object and remove the subroutine-properties from it.
01010310 : Incomplete hud chain for listener: %s
Location:
/var/log/ltm
Conditions:
A virtual server has been changed so that the client-side and server-side protocol profiles assigned to the virtual server are the same profile.
Impact:
The virtual server will be ignored, that is, connections to the virtual server will not be accepted.
Recommended Action:
Check the virtual server's client-side and server-side profile configuration and try again.
01010311 : Failed to configure VDI-enabled listener %s: %En
Location:
/var/log/ltm
Conditions:
For a virtual server on a specific VLAN with a VDI profile assigned, an attempt has been made to enable TCP connection redirections.
Impact:
An attempt to create or update a VDI-enabled virtual server will fail. The specifier in the format string will, in this case, give a particular error code to what has actually happened.
Recommended Action:
No known workaround. It is recommended to escalate to F5 if this error happens repeatedly.
01010313 : Profile %s create failed.
Location:
/var/log/ltm
Conditions:
A generic error in tmm profile update handler.
Impact:
The profile update operation might have not been completed successfully.
Recommended Action:
Check your profile update operation for a possible error.
01010314 : profile %s update: bad profile
Location:
/var/log/ltm
Conditions:
The tmm receives a profile update message, but the profile cannot be found.
The profile could have been already deleted or the create operation failed.
Impact:
The system might not function as expected.
Recommended Action:
Check that profile creation, updates, and deletions follow the expected sequence.
01010315 : Agent [%s] update: Invalid event validate
Location:
/var/log/ltm
Conditions:
The update event received by the TMM is not one of the recognized types. This can indicate a serious communication problem between the TMM and MCPD.
Impact:
Agent update was not processed.
Recommended Action:
None.
01010316 : Agent [%s] update: agent clone failed
Location:
/var/log/ltm
Conditions:
While processing an update to an agent, the TMM attempted to copy an existing agent object, but this cloning process failed.
Impact:
The agent was not successfully cloned, so the policy did not properly load into TMM. End-users might experience resets.
Recommended Action:
Updating the agent again might allow the agent to properly load.
01010317 : Agent [%s] update: agent store failed
Location:
/var/log/ltm
Conditions:
The TMM attempted to add the agent object to a collection, but failed. The failure could be due to memory pressure. It could also be due to finding a duplicate entry.
Impact:
The updated agent was not added to the collection, so the dataplane will not be able to find the updated agent. The old configuration might be used, or the dataplane might fail to find an instance of the agent object, resulting in resets.
Recommended Action:
None.
01010318 : Agent [%s] update: agent construct failed
Location:
/var/log/ltm
Conditions:
Agent construction failed. This could be due to memory pressure, or failure to retrieve fields from MCP.
Impact:
An update of agent failed to process. An old configuration might be used, or the dataplane might fail to find an instance of the object, resulting in resets.
Recommended Action:
None.
01010322 : pem protocol profile gx modify {%s}: invalid
Location:
/var/log/ltm
Conditions:
An attempt has been made to modify a non-existent Gx protocol profile.
Impact:
The Gx protocol profile modification operation will fail. There should be no impact to ongoing services.
Recommended Action:
Check for a valid Gx protocol profile prior to performing any operations on it.
01010323 : {%s, %s}: protocol message cannot be deleted, error %E
Location:
/var/log/ltm
Conditions:
An attempt has been made to modify a non-existent Gx protocol message within a valid Gx protocol profile.
Impact:
The Gx protocol message modification within a Gx protocol profile will fail. There should be no impact to ongoing services.
Recommended Action:
Check for a valid Gx protocol message in a Gx protocol profile prior to performing any operations on it.
01010324 : {%s, %s}: not found, cannot modify.
Location:
/var/log/ltm
Conditions:
An attempt has been made to modify a non-existent RADIUS or Gx protocol message within a valid protocol profile.
Impact:
The RADIUS or Gx protocol message modification within a protocol profile will fail. There should be no impact to ongoing services.
Recommended Action:
Check for a valid RADIUS or Gx protocol message in a protocol profile prior to performing any operations on it.
01010325 : pem protocol profile radius modify {%s}: invalid
Location:
/var/log/ltm
Conditions:
An attempt has been made to modify a non-existent RADIUS protocol profile.
Impact:
The RADIUS protocol profile modification will fail. There should be no impact to ongoing services.
Recommended Action:
Check for a valid RADIUS protocol profile prior to performing any operations on it.
01010326 : {%s, %s}: protocol message cannot be deleted, error %E
Location:
/var/log/ltm
Conditions:
An attempt was made to delete a RADIUS protocol message that has some deletion restrictions on it. One such restriction could be an invalid or unconfigured message.
Impact:
The RADIUS protocol message deletion will fail. There should be no impact to ongoing services.
Recommended Action:
Check for a valid RADIUS protocol message prior to performing any operations on it.
01010327 : {%s, %s}: not found, cannot modify.
Location:
/var/log/ltm
Conditions:
An attempt has been made to modify a non-existent RADIUS or Gx protocol message within a valid protocol profile.
Impact:
The RADIUS or Gx protocol message modification within a protocol profile will fail. There should be no impact to ongoing services.
Recommended Action:
Check for a valid RADIUS or Gx protocol message in a protocol profile prior to performing any operations on it.
01010328 : BDoS: (TMM) afm_provisioned=%s dos_provisioned=%s dns_bdos_licensed=%s detection=%s
Location:
/var/log/bdosd.log
Conditions:
Debug log message that displays AFM/DHD module provision status as well as dns_bdos feature flag license state.
Impact:
None. This is an informational/debug message that is logged whenever log.tmm.level is set to debug level.
Recommended Action:
To disable logging this message, change log.tmm.level to non-debug level.
01010329 : BDoS: (TMM) Signature %s: threshold_mode=%s detection=%u mitigation_curr=%llu
Location:
/var/log/bdosd.log
Conditions:
There is an ongoing DDoS attack.
Impact:
The debug log message shows the current threshold mode, detection and mitigation (rate limit) values for an existing AFM BDoS signature that is being used to mitigate a DDoS attack. This message is logged only if log.tmm.level is set to level Debug.
Recommended Action:
To disable the log message, change log.tmm.level to a log level other than Debug.
01010330 : Failed to register the Neuron App %s with the Neuron client
Location:
/val/log/ltm
Conditions:
A tmm reports that it can not register with the neurond daemon:
May 25 07:28:06 mewtwo err tmm2[14613]: 01010330:3: Failed to register the Neuron App neuron_client_tmm_bigproto with the Neuron client
The neurond is not running or enabled. Check the neurond logs and running status.
Impact:
The function in the application that tries to register with the Neuron daemon will not be available.
Recommended Action:
None.
01010331 : Neuron client %s failed with %s(%s)
Location:
/var/log/ltm
Conditions:
Neuron daemon reports the failure and the reason for the failure of an API call from the application that initiates the API call:
May 11 06:24:15 i10800-R22-S20 err tmm[25098]: 01010329:3: Neuron client neuron_client_tmm_epva_fix failed with client request submit(client connection is busy (has outstanding requests))
The neuron daemon cannot finish the API request from the client, and the Neuron SDK returns an error code that corresponds to the error message sent back to the client.
Impact:
The client functions that are specified in the API cannot complete. The application might retry or bail out, depending on the application implementation, which might affect the application functions that depend on Neuron.
Recommended Action:
There is no workaround without interrupting the operation. The neurond daemon might be restarted to see if the Neuron chip can recover.
01010332 : Neuron application %s registered
Location:
/var/log/ltm
Conditions:
Informational message showing that an application that requires Neuron functionality has successfully registered with the Neuron daemon:
May 11 06:24:15 i10800-R22-S20 notice tmm[25098]: 01010332:3: Neuron application bigproto registered
An application that requires Neuron functionality registered with the Neuron daemon during startup time.
Impact:
None.
Recommended Action:
None.
01010342 : Disabled TCP HW checksum offloading automatically disables TCP Segmentation Offload (TSO)
Location:
/var/log/ltm
Conditions:
A BigDB variable for TCP HW checksum offloading (tm.tcpudptxchecksum value software-only) is disabled.
Impact:
The BIG-IP system automatically disables TCP Segmentation Offload (TSO), thereby preventing an incorrect configuration.
Recommended Action:
None.
01010343 : Syncookie SW mode activated, server = %A:%d
Location:
/var/log/ltm
Conditions:
The SYN cookie feature is enabled on a BIG-IP Virtual Edition (VE) platform, and the system has detected a SYN flood attack.
Impact:
The platform enters software SYN cookie protection mode. When this happens, packets on this virtual server are validated for SYN cookies in order to protect the system from SYN flood attacks.
Recommended Action:
None.
01010344 : Syncookie SW mode exited, server = %A:%d
Location:
/var/log/ltm
Conditions:
The SYN cookie feature is enabled on a BIG-IP Virtual Edition (VE) platform, and the system has detected a SYN flood attack.
Impact:
The platform enters software SYN cookie protection mode. When the platform exits the SYN cookie state, the platform returns to a normal operation state.
Recommended Action:
None.
01010346 : [LTM LB][%C]%s
Location:
/var/log/ltm
Conditions:
The new "LB::enable_decisionlog" iRule command has been executed on a virtual server. This command is intended to help F5 Engineering Services debug LTM load-balancing issues.
Impact:
Extra logging to /var/log/ltm occurs, possibly resulting in reduced performance.
Recommended Action:
This message is for debugging LTM load-balancing issues, and does not need a workaround. It only appears when explicitly enabled. It is recommended that this feature only be enabled with the guidance of F5 Engineering Services.
01010347 : DynaD activated
Location:
/var/log/ltm
Conditions:
The DynaD feature is activated via the associated tmsh command (tmsh modify sys dynad instrumentation <script> active true).
Impact:
The system logs a notification message to indicate that an attempt was made to activate the DynaD feature.
Recommended Action:
None.
01010348 : DynaD inactivated
Location:
/var/log/ltm
Conditions:
This log message occurs when the DynaD feature is inactivated via the associated tmsh command (tmsh modify sys dynad instrumentation <script> active false).
Impact:
The system logs a notification message to indicate that an attempt was made to inactivate the DynaD feature.
Recommended Action:
None.
01010348 : Access Policy(%s) update: Customization group set can be only assigned to Access policy of type per-request
Location:
/var/log/ltm
Conditions:
A customization-group-set object (tmsh list apm policy customization-group-set) has been associated with an access-policy object (includes per-request policies and access policy macros) that is not of type per-request policy.
Impact:
This is an invalid configuration. The policy might fail to execute as expected.
Recommended Action:
Find the customization-group-set object and correct access-policy name in it or delete this object. Then reload the BIG-IP configuration.
01010349 : DNSSEC: Failed to parse DS record string (%s): %s
Location:
/var/log/ltm
Conditions:
When BIG-IP signs both the zone and the parent zone, it should respond to DS queries directly. This issue occurs when adding a DS record for a zone when the DS record doesn't have proper format, resulting in parse failures.
Impact:
Failure to add DS Record
Recommended Action:
Verify the format of the DS Record has proper format.
01010355 : DNS: Awaiting full DNSSEC Key %s Generation %llu from MCP
Location:
var/log/ltm
Conditions:
A DNSSEC key generation is in the process of being created, but tmm hasn't yet received the crypto portion that it needs for signing.
Impact:
This is a log level notice message and does not represent an error. It is signalling that a given DNSSEC key generation cannot be used to sign responses until the full DNSSEC key generation is received by tmm. This generally takes a second or two, at most, to be resolved.
Recommended Action:
None.
01010356 : %s: filter '%s' init failed.
Location:
/var/log/ltm
Conditions:
The initialization of a traffic filter has failed.
Impact:
The filter won't work, and traffic might be denied or dropped.
Recommended Action:
If the virtual server causing the filter to fail is known, delete and recreate the virtual server. Otherwise, reload the configuration.
01010364 : Hybrid fixed-policy setting change: from %d to %d.
Location:
/var/log/ltm
Conditions:
TMM is starting or the command "tmsh modify sys crypto acceleration-strategy fixed-ratio <value>" is run to set the new value.
Impact:
None. This is an informational message for the crypto operation offload hybrid-mode setting change.
Recommended Action:
None.
01010365 : DNSSEC: Invalid value specified for DB variable %s. Using default value.
Location:
/var/log/ltm
Conditions:
You supplied an invalid string when configuring the db variable field list of DNS resource record types used in NSEC3 responses, for either apex or under-apex DNSSEC zone queries.
Impact:
The NSEC3 types bitmap field used in a response is the listed default value, if the db variable field is invalid/configured.
Recommended Action:
Make sure the db variable field follows the format of a lowercase, space-separated list of DNS RR types.
01010371 : CMP state discrepancy between blades detected, forcing maintenance mode. Unable to relinquish maintenance mode until event clears or feature (tmm.cdp.requirematchingstates) is disabled.
Location:
The /var/log/ltm file.
Conditions:
The message is logged when:
-- A special feature, controlled by db key tmm.cdp.requirematchingstates, is enabled.
-- The feature has detected a potential internal interface failure.
This is a feature that can be enabled by BIG-IP Administrators on multi-blade standalone VIPRION units that belong to a pool on an upstream load-balancer. In no other case should this feature be enabled.
For more information, see ID 841469: Application traffic may fail after an internal interface failure on a VIPRION system :: https://cdn.f5.com/product/bugtracker/ID841469.html.
Impact:
When the feature is triggering, it causes all new conections to be rejected (as if the system was in maintenance mode). The intent of this feature is to allow the upstream load-balancer to detect that the unit is unavailable and pick a healthier member from its pool to service requests.
Recommended Action:
No workaround necessary, as the feature is simply doing its job. However, the BIG-IP Administrator should review the status of the internal interfaces, and if one is suspected defective, contact F5 Support to obtain further assistance and/or organize a replacement.
For more information, see ID 841469: Application traffic may fail after an internal interface failure on a VIPRION system :: https://cdn.f5.com/product/bugtracker/ID841469.html.
01010372 : CMP state discrepancy between blades cleared or feature (tmm.cdp.requirematchingstates) disabled, relinquishing maintenance mode.
Location:
The /var/log/ltm file.
Conditions:
The message is logged when:
-- A special feature, controlled by db key tmm.cdp.requirematchingstates, is enabled.
-- The feature has detected that an internal interface previously found not to be working is now functional again (or the BIG-IP Administrator has just disabled the aforementioned feature).
This is a feature that can be enabled by BIG-IP Administrators on multi-blade standalone VIPRION units that belong to a pool on an upstream load-balancer. In no other case should this feature be enabled.
For more information, please refer to: ID 841469: Application traffic may fail after an internal interface failure on a VIPRION system :: https://cdn.f5.com/product/bugtracker/ID841469.html.
Impact:
When the feature is triggering, it causes all new connections to be rejected (as if the system was in maintenance mode). The intent of this feature is to allow the upstream load-balancer to detect the unit is unavailable and pick a healthier member from its pool to service requests.
Recommended Action:
No workaround necessary, as the feature is simply doing its job. However, the BIG-IP Administrator should review the status of the internal interfaces, and if one is suspected defective contact F5 Support to obtain further assistance and/or organize a replacement.
For more information, please refer to: ID 841469: Application traffic may fail after an internal interface failure on a VIPRION system :: https://cdn.f5.com/product/bugtracker/ID841469.html
01020037 : The requested %s (%s) already exists
Location:
/var/log/ltm
Conditions:
A client is attempting to create a non-partitioned object that already exists in the database. The primary key for the object must be unique.
Impact:
The client's transaction will fail.
Recommended Action:
Change the value used for the object's primary key, and resubmit the transaction.
01020066 : The requested %s (%s) already exists in partition %s
Location:
/var/log/ltm
Also, UI interfaces when a transaction fails.
Conditions:
This error message occurs when attempting to create something that already exists. This can happen in a variety of ways.
(1) Simple user error. Attempt to create an object that shares the same name or identifier. For example, creating two pools with the name 'poolA'. A less obvious one is uniqueness constraints, for example ltm node's address must be unique across all partitions.
(2) Reconfigure an iApp. iApp reconfigure tends to perform delete followed by create. Ordering internally matters for logical dependencies, and can come into conflict with referential integrity constraints.
(3) If a transaction contains multiple actions over a single object. For example, if you deleted an HTTP monitor `m1` followed by creating an HTTPS monitor, naming it `m1`, then attempted to sync. Other ways of creating such transactions can be done by using tmsh transactions functionality or merge loading of configuration.
Impact:
This can cause a validation error, sync to fail, or iApp deployment to fail.
Recommended Action:
(1) If a transaction contains multiple actions over a single object, separate them into two transactions. For example, if you deleted an HTTP monitor `m1` followed by creating an HTTPS monitor, naming it `m1`, and then attempted to sync.
(2) If it is an iApp, please open a support ticket.
0102006e : IP Address %s is invalid with netmask %s, must not be the same as network address.
Location:
Wherever log local0 points when mcp unittests are being run.
Conditions:
Unit test is run.
Impact:
None.
Recommended Action:
None.
0102006f : The string does not contain only space separated integers between 0 and 4294967295
Location:
/var/log/ltm
Conditions:
Generated by the LocalLB.ProfileDiameterSession and LocalLB.ProfileDiameterRouter iControls.
The error will be logged if the user attempts to store a number greater than 4294967295 or less than 0.
Impact:
When the error occurs, the iControl will send an error message and will not store the values in mcp.
Recommended Action:
The workaround is to make sure all the values stored by these iControls fall within the range of 0-4294967295.
01060001 : Service detected %s for %s:%u monitor %s.
Location:
/var/log/ltm
Conditions:
Example:
Service detected UP for my_service:80 monitor my_monitor_name.
This message is logged for each pool member when a change is detected for its associated monitor status. Possible status might be: "UP", "DOWN", "ENABLED", "DISABLED".
Impact:
This message might not itself indicate an error, as it merely reports the detected status-change. For example, an "UP" status upon system-start is to be expected, as is a change to "DISABLED" or "ENABLED" resulting from user-initiated action (such as user action through the xui or tmsh).
However, an unexpected "DOWN" status not resulting from intentional user-initiated action might indicate an issue, such as a failed server resource or an improperly configured monitor.
Recommended Action:
This message might not itself indicate an error, but a notification of a pool member status change due to monitor results, or user-initiated action. If an unexpected "DOWN" status is reported, the user should verify the server resource availability and ensure correct monitor configuration.
01060002 : Node address detected %s for %s monitor %s.
Location:
/var/log/ltm
Conditions:
Example:
Node address detected UP for 10.10.0.1 monitor my_monitor_name.
This message is logged for each node when a change is detected for its associated monitor status. Possible status may be: "UP", "DOWN", "ENABLED", "DISABLED".
Impact:
This message might not itself indicate an error, as it merely reports the detected status-change. For example, an "UP" status upon system-start is to be expected, as is a change to "DISABLED" or "ENABLED" resulting from user-initiated action (such as user-action through the xui or tmsh).
However, an unexpected "DOWN" status not resulting from intentional user-initiated action might indicate an issue, such as a failed node or an improperly configured node monitor.
Recommended Action:
This message might not itself indicate an error, but a notification of a node status change due to monitor results, or user-initiated action. If an unexpected "DOWN" status is reported, the user should verify the node availability and ensure correct monitor configuration.
01060110 : Lost connection to mcpd with error %d, will reinit connection.
Location:
/var/log/ltm
Conditions:
Example:
Lost connection to mcpd with error <some-error>, will reinit connection.
This message is logged when 'bigd' fails to successfully read a message from 'mcpd'. The 'bigd' process will then shut down and restart to attempt re-connection to 'mcpd'.
The 'mcpd' process might have halted due to system error, or manual administrator intervention. Under normal system behavior, if the 'mcpd' process has crashed, it will automatically be restarted and the 'bigd' process will successfully re-connect. This error-message might indicate the loss of communication with the 'mcpd' process while it is restarting.
Impact:
The 'bigd' process exists to report to the 'mcpd' process resource health (resulting from probe-responses or lack thereof for monitored resources). This message indicates 'bigd' has lost connection to 'mcpd', and thus must re-establish that connection.
Recommended Action:
No user intervention is required, as 'bigd' will attempt to re-establish its connection with 'mcpd'. Confirm the 'mcpd' process is successfully running, and is not halted due to manual administrator intervention or load-failure of an improper configuration.
01060111 : Open SSL error - %s
Location:
/var/log/ltm
Conditions:
SSL/TLS warning or error in communications.
Impact:
The impact will be encountered by the daemon that is logging the error, usually bigd. If bigd is the daemon logging the error, it means that a monitor is failing the SSL/TLS connection in the way described in the log text. The monitor will mark the pool members down for all pools it is associated with.
Recommended Action:
Determine which monitor is generating the errors by isolating the pool members that are failing. For more information on determining which pool member is failing, see SOL13768: Identifying which pool members are failing an SSL/TLS handshake.
Once you have identified the affected https monitor, first see SOL12531: Troubleshooting health monitors.
Check the monitor's cipher list to ensure that the cipher list is compatible with the pool members that it is connecting to. Do not put TLSv1_0 in the cipher list. Test your cipher list by running 'openssl ciphers <cipherlist>' at the command line using the cipher list from the monitor. For more information, see SOL16526: Configuring the SSL cipher strength for a custom HTTPS health monitor.
If you have a custom monitor connecting to a server running an old version of openssl, read SOL17183: The HTTPS monitor may incorrectly mark pool members down due to SSL SessionTicket Extension.
01060136 : Received links up - monitoring starts.
Location:
/var/log/ltm
Conditions:
Example (v11.6.0, and earlier):
Received links up - monitoring starts.
Example (v11.6.1, and later):
(_set_db_variable): adaptive tmstat logging enabled: true
This message is logged in v11.6.0, and earlier, when the 'bigd' process receives a "links-up" message indicating that monitoring can proceed, at which point 'bigd' begins monitoring (sending probes and processing responses).
This is an indication of proper behavior. When 'bigd' starts, it waits for an initial "links-up" message to indicate gateways are configured. Otherwise, sending monitor-probes might cause false gateway failsafe failovers to occur, and generate false monitor failures. After receiving the "links-up" message, any gateway failsafe failovers or monitor failures are genuine.
Starting in v11.6.1, this message is removed. However, a similar message is inserted to note status-changes, as follows:
Example:
"(_set_db_variable): adaptive tmstat logging enabled: true"
Impact:
This message is not an error, but a notification that 'bigd' began its logging (sending probes and processing responses).
Recommended Action:
None.
01060145 : Pool %s member %s monitor status %s. [ %s ] [ %s ]
Location:
/var/log/ltm
Conditions:
Example:
Pool my_pool member my_member1 monitor status up. [ my_member1: UP, my_member2: UP %s ] [ was down ]
This message is logged when a status change is detected in a pool member. The message reports the parent pool name, the new pool member status, the status of all pool member peers, and the previous status for this pool member that had the status-change.
Possible pool member status includes: "unchecked", "checking", "forced up", "up", "down", "forced down", "irule down", "down", "down; waiting manual resume", "disabled", "checking".
Impact:
This message might not itself indicate an error, as it merely reports the detected status-change. For example, a pool member will typically transition through several status-changes upon system-start such as "unchecked"=>"checking"=>"up". Similarly, user-initiated actions (such as through the xui or tmsh) might forcibly set the status to "forced down" or "disabled".
However, an unexpected "down" status might indicate an issue, such as a failed server resource, or an improperly configured pool member or monitor.
Recommended Action:
This message might not itself indicate an error, but a notification of a pool member status change. If an unexpected "down" status is reported, the user should verify the server resource availability, and ensure a correct pool member and monitor configuration.
01060146 : Bigd PID %d, instance %d, overloaded.
Location:
/var/log/ltm
Conditions:
The system posts this message whenever bigd indicates excessive load. It occurs when the bigd daemon's ability to complete monitoring tasks is challenged by the number of monitor instances, the frequency of probe intervals, or the complexity of pool member/node types.
Impact:
bigd might fail to service monitors in a timely fashion, which might result in 'flapping' nodes/pool members (where the node/pool member goes down and back up even though the server itself has not gone down).
Recommended Action:
You can mitigate overload issues in the following ways:
Reduce the number of monitor instances.
Increase the probe time to probe less often.
Switch monitored pool members/nodes to simpler, lower-overhead monitors (e.g., ICMP instead of HTTP, or HTTP instead of HTTPS).
01060156 : Bigd PID %d, instance %d, fail to serialize 'bigd=>mcpd' message (exceed msg-length limit?): %s.
Location:
/var/log/ltm
Conditions:
The 'bigd' service has attempted to send a message to the 'mcpd' service that exceeds the maximum message size limit.
Impact:
This is a diagnostic message, and does not itself indicate an error. The user need not perform any action, and the system will continue monitor logging.
Recommended Action:
None.
01060157 : Receive string cannot be empty for reverse monitor '%s'
Location:
/var/log/ltm
Conditions:
Attempting to use a monitor on a node or pool member, where the monitor is a reverse monitor and the receive string is empty.
Impact:
The monitor instance will fail to run in bigd.
Recommended Action:
Enter a receive string or use a different monitor.
01060158 : Disable string must be empty for reverse monitor '%s'
Location:
/var/log/ltm
Conditions:
Attempting to use a monitor on a node or pool member, where the monitor is a reverse monitor and the disable string is non-empty.
Impact:
The monitor instance will fail to run in bigd.
Recommended Action:
Clear the disable string or use a different monitor.
01070007 : Received shutdown signal %d
Location:
/var/log/ltm
Conditions:
Mcpd logs this notice as a result of receiving a SIGTERM (15), SIGINT (2), or SIGHUP (1) signal.
SIGTERM is sent on behalf of `bigstart restart mcpd` when issued on the command line by the user.
Impact:
Mcpd will restart, which subsequently causes multiple daemons to restart as well.
Recommended Action:
Do not use `bigstart restart mcpd`.
01070043 : Monitor %s parent not found.
Location:
/var/log/ltm
Conditions:
Example:
Jan 26 14:10:21 localhost err mcpd[5090]: 01070043:3: Monitor /Common/foo parent not found.
This message reports a failure to create a new monitor because the referenced parent-monitor does not exist (from which the new monitor was to copy default-parameters). The following command generates this error:
tmsh create ltm monitor http foo defaults-from MyMonitorNoExist
...error in '/var/log/ltm':
Jan 26 14:10:21 localhost err mcpd[5090]: 01070043:3: Monitor /Common/foo parent not found.
In this case, the 'foo' monitor is not created because the parent 'MyMonitorNoExist' did not exist.
Impact:
No operation occurred (the create-monitor attempt fails, and the configuration is not modified).
Recommended Action:
When creating a new monitor that uses 'defaults-from', an existing monitor of the appropriate type should be specified.
0107004e : LTM configuration is not allowed when VCMP is provisioned. Virtual server %s conflicts with VCMP.
Location:
/var/log/ltm, tmsh, GUI
Conditions:
Creating or enabling virtual servers while VCMP is provisioned.
Impact:
Virtual server can't be used when VCMP is provisioned.
Recommended Action:
Delete all virtual servers when VCMP is provisioned.
01070069 : Subscription not found in mcpd for subscriber Id %s.
Location:
/var/log/ltm
Conditions:
The system process named in the message is attempting to unmark itself as a subscriber, but has specified a subscriber name that it had not previously used.
This message occurs during system shutdown or restart.
Impact:
No user impact. This message implies that there is a defect in TMOS, but a comparatively minor one. There is no risk of system instability or dropped traffic.
Recommended Action:
None.
01070147 : Snatpool %s must reference at least one translation address.
Location:
/var/log/ltm
Conditions:
Example:
Snatpool my_pool must reference at least one translation address.
A SNAT pool is configured, and set as active; but has no SNAT pool members.
Impact:
The configuration failed to load, and the SNAT pool is unavailable.
Recommended Action:
User should set the empty SNAT pool to inactive, or add pool members. Alternatively, user could configure SNAT without pools, such as for 'standard' (explicitly specifying the translation address) or 'automap' (allowing the system to auto-assign from the BIG-IP device's existing self-IP addresses), or 'intelligent' (SNAT mapping implemented within an iRule).
After configuration repair, the configuration can be reloaded and the SNAT pool should be available (no reboot is required).
01070151 : Rule [%s] error: %s
Location:
/var/log/ltm or GUI.
Conditions:
This is a general TCL parsing error message caused when validating iRules.
The TCL error itself is present in the log message and includes information about the offending code, which quickly allows resolution in most cases.
The message can be triggered whenever an iRule is updated:
- either using the GUI by clicking update;
- saving the edited iRule when using the tmsh commend (for example, edit ltm rule <x>)
Errors will appear in the GUI or the ltm log file and examples include:
Rule [<rule_name>] error: <rule_name>:1: error: [parse error: missing close-brace][{ set port [TCP::local_port] if { $p == 443) log local0.info]
Rule [<rule_name>] error: <rule_name>:1: error: [command is not valid in the current scope][set sp [class match -value [string tolower [IP::local_addr]] equals dg_test ]]
Rule [<rule_name>] error: <rule_name>:2: error: [unexpected extra argument "="][TCP::local_port = 443]
Rule [<rule_name>] error: <rule_name>:9: error: [missing a script after "else"][]
Rule [<rule_name>] error: <rule_name>:3: error: ["invalid argument local0"][log local0 "MATCH OK"]
Rule [<rule_name>] error: <rule_name>:8: error: [invalid keyword "{ log local0. "in CLIENT_ACCEPTED" if { $cond }" must be: priority timing][when CLIENT_ACCEPTED { { log local0. "in CLIENT_ACCEPTED" if { $cond }" ]
Impact:
Updating of the iRule will not be performed and corresponding logic changes will not be applied to any associated virtual servers.
The iRule code needs to be corrected prior to successful update.
Recommended Action:
Inspect the error message and locate the error in the iRule code.
Once located, correct the error. The correction depends on the contents of the error generated.
For simple syntax errors like 'missing brace' or 'unexpected extra argument', inspect the code around the designated error line indicated in the log message and ensure braces ('{') are paired, and commands used (for example, [TCP::local_port]) have the correct number of arguments.
For errors that involve use of the wrong commands, ensure that the commands are valid to use in the current setting (for example, PEM commands require PEM to be licensed).
Some errors might be caused due to incorrectly referenced configuration objects. A common case is referring to a Data Group that is not yet configured when the iRule is updated. In these cases, ensure that the dependent configuration objects exist and that the references in the iRules are using the correct names.
01070165 : "License file stat fails: %s."
Location:
/var/log/ltm
Conditions:
The file /config/bigip.license doesn't exist or there are errors accessing the file.
Impact:
The BIG-IP system is not licensed.
Recommended Action:
License the BIG-IP system or check the file /config/bigip.license.
01070259 : Requested member (%s) is untagged on another VLAN
Location:
/var/log/ltm
Conditions:
A VLAN is configured with an interface as an untagged member. When an additional vlan is configured with the same interface as an untagged member, the configuration will fail with this error message.
Impact:
VLAN configuration will fail.
Recommended Action:
You must correct your VLAN configuration. Either remove the interface from the previously configured VLAN, where it appears as an untagged member, or add it to the new VLAN as a tagged member.
0107025d : Nameserver for Wide IP Zones (%s) is not a fully qualified domain name or contains invalid characters.
Location:
/var/log/gtm
Conditions:
The value of GTM Globals Nameserver is not a fully-qualified domain name, or it contains invalid characters.
Impact:
The GTM Globals Nameserver value needs to a fully-qualified domain name, such as ns.example.com. The default value will be used for all Nameserver records that ZoneRunner automatically created. The default value is "this.name.is.invalid."
Recommended Action:
Choose a valid domain name that is registered to the user's domains.
0107025e : Nameserver for Wide IP Zones is empty. A valid, fully qualified domain name must be specified.
Location:
GUI, CLI
Conditions:
A user has modified the GTM global settings and left the "WideIP Zone Nameserver" field empty.
Impact:
The settings are not updated.
Recommended Action:
Do not leave the "WideIP Zone Nameserver" field empty.
01070261 : Can't create a home directory for username %s (%s)
Location:
LTM log.
Conditions:
The reason for the failure is described in the parenthesized portion of the message.
Impact:
The user is created, but the user cannot log in.
Recommended Action:
No general workaround. The error described in the message is required to determine this information.
01070265 : The %s (%s) cannot be deleted because it is in use by a %s (%s)
Location:
/var/log/ltm
Conditions:
Mcpd will log this when a client is attempting to delete a configuration that is currently being used by another configuration object.
Impact:
The transaction will fail and rollback; mcpd will be in the state it was in just prior to attempting the transaction.
Recommended Action:
Remove or reconfigure the object that is referencing the configuration object that you want to delete.
01070277 : The requested %s (%s) was not found
Location:
In tmsh or the GUI, as the response to a request to create or modify configuration.
Conditions:
The user referred to a configuration object that does not exist.
Impact:
The requested change failed validation and no change to the configuration occurred.
Recommended Action:
Correct the spelling of the object name or choose a different object.
0107028a : The source address (%s) for virtual server (%s) must have a prefix length.
Location:
/var/log/ltm
Conditions:
Example:
The source address (10.10.0.5) for virtual server (my_server) must have a prefix length.
This message is logged upon configuration load when a virtual server is missing its prefix length, which is required to identify the virtual server subnet.
The virtual server is configured in CIDR notation including the IP address and prefix length, such as 192.168.100.0/24. The prefix length (mentioned in the message) is the number of bits set in the network mask, such as a prefix length of 24 associated with a subnet mask of 255.255.255.0.
Impact:
The configuration for this virtual server failed to load (because its configuration is improper), and this virtual server is unavailable.
Recommended Action:
User should configure the virtual server with its IP address and prefix length (in CIDR notation, such as 192.168.100.0/24), and reload the configuration.
01070301 : Pool (%s) is referenced by one or more virtual servers
Location:
/var/log/ltm
Conditions:
This message is logged when a user-initiated attempt is made (such as through xui or tmsh) to delete a pool that is currently referenced by one or more virtual servers. Deleting a pool that is still referenced by a virtual server is not permitted, as it would result in a (dangling) foreign key reference from the virtual server to the now-deleted pool.
Note that this message is removed in v11.5.0 (and thus is reported only in v11.4.1 and earlier). In v11.5.0 and later, validation of foreign keys from a virtual server to a pool is performed differently, thereby removing this message from the codebase.
Impact:
No action is taken, and the pool is not deleted (the pool is unchanged). This message merely logs the rejection of the user-initiated attempt to delete a pool.
Recommended Action:
User should first remove the pool references by any virtual server, and then delete the pool. When the pool is not referenced by any virtual server, the pool delete operation will successfully complete and this error message will not be logged.
0107030c : Host persistence requires an HTTP profile to be associated with the virtual server
Location:
/var/log/ltm, GUI
Conditions:
A virtual server has been configured to use HTTP Host persistence. That virtual server has no HTTP profile attached to it.
Impact:
The configuration is inconsistent, and will fail to load.
Recommended Action:
Add an HTTP profile to the virtual server requiring HTTP Host persistence. Or choose another kind of persistence profile that doesn't require an HTTP profile on the virtual server.
01070315 : profile %s requires a key
Location:
/var/log/ltm
Conditions:
A 'key' is missing from the cert-key-chain object that is associated with a clientSSL profile. Or, 'key' is missing from the server SSL profile, when 'cert' is present.
Impact:
This results in mcpd validation failure of the specific clientSSL/serverSSL profile, resulting in failure of mcpd operation/transaction.
Recommended Action:
In order to fix the issue, user needs to add 'key' to cert-key-chain object in clientSSL profile, or to the serverSSL profile.
01070318 : The requested media %s for interface %s is invalid.
Location:
/var/log/ltm
Conditions:
The user attempts to set the media on an interface to an invalid type.
Impact:
The change does not take effect.
Recommended Action:
Do not attempt to set the interface media to an invalid value.
Use "tmsh list net interface X media-capabilities" command to see a list of accepted media values for interface X.
01070320 : Snatpool %s is still referenced by a virtual server.
Location:
/var/log/ltm
Conditions:
User-initiated action (such as through tmsh or xui) attempted to delete a SNAT pool that is still being referenced by a virtual server or SNAT.
Impact:
No action occurred, and the attempt to delete the SNAT pool failed (the SNAT pool is unaffected).
Recommended Action:
User should first remove the SNAT pool from being referenced by the virtual server or SNAT object. A subsequent attempt to delete the SNAT pool will then succeed.
0107032f : The vlan (%s) associated with the static route %s/%d must have a Self IP using the IPv%u protocol.
Location:
/var/log/ltm, GUI, console
Conditions:
The system is attempting to create a static route when none of the self-IP addresses for the static route are on the same interface and the addresses do not use the same IP protocol format (IPv4 or IPv6).
Impact:
The system cannot create a static route.
Recommended Action:
Create all self-IP addresses for the static route on the same interface and ensure that the addresses use the same IP protocol format.
01070340 : %s (%s) is referenced by one or more rules
Location:
/var/log/ltm
Conditions:
One common problem is, an object is to be deleted, but it is still referenced actively, because there are multiple references to one object.
Impact:
Because of this error, the user action will fail. For example, if there are multiple references to an object and user attempts to delete it, the system does not delete it.
Recommended Action:
User needs to search for the object indicated in the message across the iRules, and remove the object dependency before deleting the object.
01070341 : Virtual server %s references rule %s which does not exist.
Location:
/var/log/ltm
Conditions:
A configuration load or change contains a virtual server that references a rule that does not exist.
Impact:
The rule associated with the virtual server could not be found, and is not active.
Recommended Action:
User should confirm the rule exists when referenced by a virtual server. Confirm that the rule exists, and that the name referenced by the virtual server is spelled correctly.
01070354 : Self IP %s / %s: This network is defined on two vlans (%s and %s)
Location:
/var/log/ltm, console, and GUI.
Conditions:
The self IP being created is on a network that is in a different VLAN than the one specified during self IP creation.
Impact:
MCPD will prevent the self IP address from being created until the conflict is resolved.
Recommended Action:
Create the self IP in the current VLAN.
01070356 : %s feature not licensed
Location:
/var/log/ltm
The contents of /var/log/ltm may be viewed in the GUI under System > Logs > Local Traffic. These messages are of the form "<FEATURE_NAME> feature not licensed." The <FEATURE_NAME> list of items regularly increases with each release.
Conditions:
These messages occur whenever mcpd queries the license for a feature flag that is not in the license. This message typically occurs during configuration validation.
Impact:
There is no single consistent BIG-IP action, or easily counted set of actions, associated with these messages. In general, however, the feature named in the message does not function, and the BIG-IP system might not achieve the Active operational state.
Recommended Action:
Upgrade the license to support the requested features. Downgrade the BIGIP software to a version that does not require the unlicensed features, or modify the configuration to remove objects that depend on the unlicensed features. The probable cause for these messages is using a configuration file from a more feature-rich license, or the release of BIG-IP software with a less feature-rich license or software image.
01070392 : Self IP %s / %s: This IP shares a network with %s (%s / %s).
Location:
/var/log/ltm, console, and GUI.
Conditions:
The self IP being created conflicts with the admin address of the BIG-IP device.
Impact:
MCPD will prevent the self IP address from being created with the conflicting address.
Recommended Action:
Either create the self IP with a different address, or correct the conflicting admin address of the BIG-IP device.
01070394 : %s in rule (%s) requires an associated %s profile on the virtual server (%s)
Location:
/var/log/ltm
Conditions:
A configuration load contains a rule associated with a virtual server, but the required profile was not found on that virtual server. The intended profile might be present in the virtual server, but was misspelled in the rule, or the required profile was not associated with the virtual server.
Note that this message is used only on v11.6.1, and earlier.
Impact:
The configuration failed to load, and the rule is not in effect.
Recommended Action:
User should change the rule to reference a profile present on the virtual server. Confirm that the identified profile in the rule is properly spelled, and that the profile is associated with the virtual server. The configuration might then be reloaded (a reboot is not required).
01070404 : Add a new Publication for publisherID %s and filterType %p
Location:
/var/log/ltm
Conditions:
A system process has started up and connected to mcpd. This process is registering as a publisher, meaning that mcpd acts as a proxy for certain user commands that require obtaining data from this process. For example, when the user runs the command 'show sys connection', this will be forwarded to TMM instances, and their responses will be forwarded back to the user's shell.
Impact:
This message does not indicate a problem with the system.
Recommended Action:
None.
01070406 : Removed publication with publisher id %s
Location:
/var/log/ltm
Conditions:
A system process is removing itself as a publisher. See error catalog item 620989 for a description of the publishing mechanism.
Impact:
This message does not indicate a problem with the system. The most common case it would be seen is a shutdown or reboot of the system. If the publishing process is exiting unexpectedly, it will generate its own log messages.
Recommended Action:
None.
01070407 : Removed information for Publication %s and filterType %p
Location:
/var/log/ltm
Conditions:
A system process is removing itself as a publisher, but only for certain types of messages. It remains a publisher for other types of messages. See error catalog item 620989 for a description of the publishing mechanism.
Impact:
This message does not indicate a problem with the system.
Recommended Action:
None.
01070408 : Deleting abandoned subscriber connection for %s
Location:
/var/log/ltm
Conditions:
A system service has restarted and subscribed to mcpd objects without cleaning up after itself in its previous instantiation.
Impact:
This indicates a problem that is resolving itself. mcpd is not impacted, although whatever caused the other process to restart might be a concern. That failure would log its own error messages.
Recommended Action:
None.
01070410 : Removed subscription with subscriber id %s
Location:
/var/log/ltm
Conditions:
A system process is ending its subscription to mcpd objects. This is the mechanism by which this process is informed about updates to the configuration.
This is a clean unsubscription, so the system is likely shutting down or restarting.
Impact:
This message does not indicate an error.
Recommended Action:
None.
01070413 : Updated existing subscriber %s with new filter class %llx
Location:
/var/log/ltm
Conditions:
A system process is changing the set of configuration objects about which it is concerned. This is the mechanism by which this process is informed about updates to the configuration.
Impact:
This message does not indicate an error.
Recommended Action:
None.
01070417 : AUDIT - user %s - transaction #%u-%u - object %u - %s
Location:
/var/log/audit
Conditions:
Auditing changes made to configuration in mcpd.
Impact:
Not an error.
Recommended Action:
None.
01070418 : connection %p (user %s) was closed with active requests
Location:
/var/log/ltm
Conditions:
Two possible conditions:
* A system service is connected to mcpd and has started a transaction, but not written anything to it for five minutes, indicating that it likely is no longer using it.
* A connection was closed while mcpd had not yet finished responding to it.
Impact:
This message might indicate a minor TMOS bug, but one that is likely to quickly resolve with no impact.
Recommended Action:
None.
01070419 : Platform initialization phase triggered
Location:
/var/log/ltm
Conditions:
mcpd logs this message as a result of entering the first of four initialization phases.
Impact:
This is the expected behavior of a healthy mcpd on startup.
Recommended Action:
None.
01070421 : Base configuration initialization phase triggered.
Location:
/var/log/ltm
Conditions:
mcpd is starting up from configuration files, as opposed to being restored from a binary file. The binary file either did not exist prior to mcpd starting or it may have been corrupted.
Base configuration initialization phase is #2 of 4 total initialization phases.
Impact:
Restoring from configuration files on startup is part of normal operation, and as a result, mcpd should become fully operational (contingent upon successful completion).
Recommended Action:
None.
01070424 : Full configuration initialization phase triggered.
Location:
/var/log/ltm
Conditions:
mcpd is starting up from configuration files, as opposed to being restored from a binary file. The binary file might not have existed prior to mcpd starting, or it might have been corrupted.
Impact:
Restoring from configuration files on startup is part of normal operation; as a result, mcpd should become operational.
Recommended Action:
None.
01070427 : Initialization complete. The MCP is up and running
Location:
/var/log/ltm
Conditions:
mcpd successfully completed initialization, which means all configuration loaded and reached a running phase.
Impact:
mcpd function as designed
Recommended Action:
None.
01070465 : DB changed: %s, configsync needed
Location:
/var/log/ltm
Conditions:
If a BIG-IP device is in an HA pair, config sync autodetect is enabled, and a db variable is modified.
More specifically, if the following db variables are set:
1. failover.isredundant value true
2. configsync.autodetect value enabled
Impact:
No impact. This is information only.
Recommended Action:
Disable config sync autodetect or ignore.
01070466 : Received end of platform data
Location:
/var/log/ltm
Conditions:
Mcpd logs this message in response to receiving the end_platform_id request from chmand. This is a normal part of the boot process, and is the result of chmand publishing platform info to an initialized mcpd. This message can be seen every time mcpd starts up.
Impact:
Mcpd can now perform actions that require the platform object, such as install the VCMP n-stage validator. This is expected behavior.
Recommended Action:
None.
01070468 : %s
Location:
/var/log/ltm
Conditions:
A transaction to change the configuration successfully completes and the log.mcpd.level db variable is set to debug.
Impact:
None.
Recommended Action:
None.
01070596 : An unexpected failure has occurred, %s, exiting...
Location:
/var/log/ltm
Conditions:
mcpd has reached an unrecoverable error.
Impact:
mcpd will restart, along with most other system services. Traffic will be lost.
Recommended Action:
Often this will resolve itself after one restart. If not, removing the binary database (rm -vf /var/db/mcp*) is another common cause for some instances of this error.
01070599 : Current management-ip (%s) has to be deleted before adding a new management-ip (%s) with the same address family.
Location:
/var/log/ltm
Conditions:
The user attempts to create a sys management-ip of an address family that is already configured.
Impact:
The configuration operation fails.
Recommended Action:
Delete the clashing management-ip before adding the correct one.
01070604 : Cannot delete IP %s because it would leave a route unreachable.
Location:
/var/log/ltm
Conditions:
When removing a self-ip, and the address is the only way in which a static route can be reached, the deletion would strand the route.
Impact:
The condition prevents a static route from being removed.
Recommended Action:
Remove any static route that utilizes the self-ip, and try the deletion again.
01070608 : License is not operational (expired or digital signature does not match contents)
Location:
/var/log/ltm
Conditions:
*) This message is logged when the license was not reactivated before an upgrade, and the license's check service date is older than the release date of the install.
*) This message is logged when the license has been modified, or the digital signature does not match the contents.
Impact:
The BIG-IP system is not licensed.
Recommended Action:
If a support contract is current, reactivate the license. Reactivation can be performed from the GUI on a running boot location, or by using tmsh (tmsh install sys license).
01070622 : The monitor %s has a wildcard destination service and cannot be associated with a node that has a zero service
Location:
Associating a pool member with a zero port with a monitor that requires a port generates error message in question.
Conditions:
Pool member with zero port; associated monitor that requires a port (for example TCP or HTTP).
Impact:
Monitors that require a destination port cannot be associated with pool members where the port is unspecified or zero.
Recommended Action:
Assure that the pool member has a non-zero specified port.
01070638 : "Pool %s member %s:%u monitor status %s."
Location:
/var/log/ltm
Conditions:
Example:
Pool my_pool member 10.10.0.5:80 monitor status forced down.
This message is logged when a status change is detected for the pool member, resulting in the pool member being in a status other than 'up'. Possible status values are: 'unchecked', 'node down', 'down', 'forced down', 'up and awaiting man resume', 'iRule down', 'inband down', 'FQDN down'. Note that the 'up' status is not listed, because this message is not reported when the pool member status is 'up'.
The pool member status is dependent upon the virtual server configuration, and the configuration and health status results for associated monitors.
Impact:
This message might not itself indicate an error, because it merely reports the detected pool member status change. For example, user-initiated action (such as through the xui or tmsh) might explicitly change the pool member status (such as to 'forced down' for maintenance). However, an unexpected 'down' status might indicate a configuration or resource availability issue.
Note also that the parent pool status might be unchanged as a result of this pool member status change, as long as the threshold is not exceeded for the number of available pool members required for the parent pool to be available.
Recommended Action:
If an unexpected 'down' status is reported, verify the pool member configuration, the configuration of associated pool member monitors, and the resource availability to ensure pool member availability.
01070639 : Pool %s member %s:%u session status %s.
Location:
/var/log/ltm
Conditions:
Example:
Pool my_pool member my_member:80 session status forced disabled.
This message is logged when "session-status" is changed, such as from user action to "enable" or "disable". Possible status includes: 'enabled', 'node disabled', 'disabled', and 'forced disabled'.
Impact:
This message is a log-notification only when the pool member session status changes.
Recommended Action:
This is not an error, but a notification of a pool member status change that records the resulting status.
01070640 : Node %s address %s monitor status %s.
Location:
/var/log/ltm
Conditions:
Example:
Node my_node address 10.10.0.1 monitor status forced down.
This message is logged when a status change is detected for the node, resulting in the node being in a status other-than 'up'. Possible status values are: 'unchecked', 'node down', 'down', 'forced down', 'up and awaiting man resume', 'iRule down', 'inband down', 'FQDN down'. Note that the 'up' status is not listed, because this message is not reported when the node status is 'up'.
The node status is dependent upon node configuration and heath results for associated node monitors.
Impact:
This message might not itself indicate an error, as it merely reports the detected node status change. For example, user-initiated action (such as through the xui or tmsh) might explicitly change the node status (such as to 'forced down' for maintenance). However, an unexpected 'down' status might indicate a configuration or resource availability issue.
Recommended Action:
This message might not itself indicate an error, but a notification of a node status change due to monitor results, or user-initiated action. If an unexpected 'down' status is reported, verify the node configuration, the configuration of associated node monitors, and the resource availability to ensure node availability.
01070690 : Port mirroring is not supported on this platform.
Location:
/var/log/ltm
Conditions:
This occurs if you configure port mirroring on a platform that does not support port mirroring.
Impact:
You will not be able to configure port mirroring.
Recommended Action:
None.
0107070e : Software version not covered by service agreement. Reactivate license before continuing.
Location:
/var/log/ltm
The contents of /var/log/ltm can be viewed in the GUI under System->Logs->Local Traffic.
Conditions:
The BIG-IP software version used was released after the Service Check Date specified in the license.
Impact:
The BIG-IP system is not usable in this state. You must either upgrade the license, to one for the installed software version, or revert to a BIG-IP software version that the current license supports.
Recommended Action:
You must either upgrade the license, to one for the installed software version, or revert to a BIG-IP software version that the current license supports.
01070712 : "Caught configuration exception (%d), %s."
Location:
/var/log/ltm
Conditions:
MCPD logs this error in response various configuration issues that might arise while attempting to process a transaction. The nature of the issue could be caused by any number of runtime scenarios, for example, "can't get class information from schema repository", "invalid MAC address", "Can't get class definition while retrieving sub classes", etc.
Impact:
MCPD will stop processing the current transaction and roll back to the last valid state.
Recommended Action:
Depending on the message being logged, modify the configuration that caused the error, and then attempt to submit the transaction again.
01070727 : "Pool %s member %s:%u monitor status up."
Location:
/var/log/ltm
Conditions:
Example:
Pool my_pool member 10.10.0.5:80 monitor status up.
This message is logged when a status change is detected for the pool member, resulting in the pool member being marked 'up'. The pool member status is dependent upon virtual server configuration, and the configuration and health results from associated monitors.
Impact:
This message is not an error, but merely reports the detected 'up' pool member status. This message is expected upon system start, where properly configured pool members transition to an 'up' status.
Recommended Action:
None.
01070728 : Node %saddress %s monitor status up.
Location:
/var/log/ltm
Conditions:
Example:
Node my_node address 10.10.0.1 monitor status up.
This message is logged when a status change is detected for the node, resulting in the node being marked 'up'. The node status is dependent upon node configuration and health results for associated node monitors.
Impact:
This message is not an error, but merely reports the detected 'up' node status. This message is expected upon system start, where properly configured nodes transition to an 'up' status.
Recommended Action:
None.
01070730 : Configuration restored from binary image
Location:
/var/log/ltm
Conditions:
Mcpd loaded the configuration from a binary image format on disk.
Impact:
The binary image is considered to be saved in a valid state, so restoring from the binary means that the BIG-IP system does not run validation and business logic, as it typically would when processing configuration (/config/*.conf) files.
Recommended Action:
Loading from binary is typically a desirable behavior as it's faster than processing configuration files; however, if one wanted to run business logic and validation, you could remove the binary file and restart mcpd, for example,
rm -f /var/db/mcpdb.*
bigstart restart mcpd
01070734 : Configuration error: %s
Location:
/var/log/ltm
This error appears in the GUI, as a result of a configuration update.
Conditions:
This error is a validation exception, usually occurring when a user attempts to update the configuration.
The most common ways for user error include:
1) Invalid naming.
No keywords, empty names, special characters, etc.
2) Invalid value for an attribute.
Can be value ranges, NULL constraints, and other defined domains.
3) Dependency required.
Let X and Y be two different classes. When an X is configured, a related Y must be configured.
4) Invalid reference to another object.
Can be a permissions problem, a NULL constraint, or the object referenced doesn't exist.
Let X and Y be two different classes. X must configure an X.a. When X.a references Y, Y must exist and X must be allowed to refer to Y.
5) Logical constraints of attributes.
Let X be a class. When X.a is configured, X.b must not be configured.
Impact:
A transaction can fail upon encountering this exception.
Recommended Action:
Check the configuration update and correct the issue.
01070736 : Couldn't write to the user/role/partition file, %s (%d)
Location:
/var/log/ltm, and in tmsh
Conditions:
There is some error writing the user role partition file, which indicates a disk error. The error message includes errno from the failed operation, which might give more specific information about the cause.
Impact:
The transaction containing changes to the user role partition file is rolled back. If the error persists, changes to user roles and partition access will be impossible.
Recommended Action:
Examine the errno in the error message to determine more information about the root cause, and resolve that.
01070756 : Diameter monitor '%s' has invalid mode '%s'
Location:
/var/log/ltm
Conditions:
Whenever MCP identifies that the mode configuration parameter of the diameter monitor is invalid before it stores in the MCP database.
Impact:
Does not update the specified value for the mode configuration parameter of the diameter monitor.
Recommended Action:
None.
01070807 : Monitor %s instance %s:%u has been %s.
Location:
/var/log/ltm
Conditions:
Examples:
Monitor my_http instance 10.10.0.2:80 has been enabled.
Monitor my_http instance 10.10.0.2:80 has been disabled.
This message is logged when the user changes the monitor instance status to either 'enabled' or 'disabled', such as through tmsh or the xui. A 'disabled' monitor sends no health-check probes, and thus does not contribute to an indication of the resource's health. Disabling a monitor does not otherwise impact availability of the monitored resource.
Impact:
This message is log-notification only when the monitor instance status is changed between 'enabled' and 'disabled'.
Recommended Action:
This is not an error, but a notification of monitor instance status change that records the resulting status.
01070822 : "Access Denied: %s"
Location:
/var/log/ltm, CLI, GUI
Conditions:
User attempts to read, modify, or delete a config that they do not have access to, per the partition access settings, or attempts to perform an action that is not allowed for the role. The error message describes more precisely what access was denied.
Impact:
User is prevented from doing things they are not authorized to do.
Recommended Action:
If the user needs access to config or actions, then the user must be given sufficient partition/role access.
01070823 : Read Access Denied: %s
Location:
/var/log/ltm, shown in tmsh
Conditions:
A user attempts to query objects or stats in a partition to which the user does not have read access, or attempts to query non-partitioned objects but does not have non-partitioned read access.
Impact:
User is not able to read the desired objects or stats.
Recommended Action:
If the user needs read access to the objects or stats, then the user must be given a role on the appropriate partition with read access.
01070827 : User login disallowed: %s
Location:
/var/log/ltm
Conditions:
Attempt to log in as a user with no partition access specified.
Impact:
Unable to log in as user with no partition access specified. Such a user has no access.
Recommended Action:
Specify partition-access for every user account that needs access to the BIG-IP device.
01070830 : The iRule (%s) cannot be deleted because it is in use by a %s (%s) %s (%s).
Location:
When an iRule is configured under a firewall policy rule, deleting that iRule should report an exception.
Conditions:
-- AFM is provisioned.
-- An iRule is configured under a firewall rule.
-- You attempt to delete that iRule.
Impact:
Cannot delete an iRule configured under a firewall rule. This is correct behavior.
Recommended Action:
None.
01070921 : Virtual Server '%s' on partition '%s' %s by user '%s'.
Location:
/var/log/ltm
Conditions:
A user (with sufficient permissions) has enabled or disabled a virtual server.
Impact:
The virtual server is either enabled or disabled as requested; the network service(s) provided by the virtual server were either made available or made unavailable.
Recommended Action:
This is a user requested action, not an issue with the product.
01070927 : Request failed, data provider (%s) disconnected from mcpd
Location:
/var/log/ltm
Conditions:
The system process named in the message is attempting to unmark itself as a publisher, but has specified a publisher name that it had not previously used. See error catalog item 620989 for a description of the publishing mechanism.
This message occurs during system shutdown or restart.
Impact:
No user impact. This message implies that there is a defect in TMOS, but a comparatively minor one. There is no risk of system instability or dropped traffic.
Recommended Action:
None.
01070931 : Clustering quorum reached
Location:
/var/log/ltm
Conditions:
Any chassis platform during normal start up.
Impact:
This message indicates that the 'quorum' stage of the chassis clustering algorithm has been reached.
Recommended Action:
None.
01070933 : License blob received from primary.
Location:
/var/log/ltm
Conditions:
On a cluster with more than one member.
Impact:
None.
Recommended Action:
None.
01070967 : The specified vlan, vlangroup or tunnel (%s) cannot be removed from its default route domain (%s).
Location:
/var/log/ltm
Conditions:
When trying to remove VLAN or VLAN-GROUP from default route-domain, without attaching to another route-domain.
Impact:
Validation error, no operation impact. Action will be prevented.
Recommended Action:
None.
01070978 : The vlan (%s) for the specified self IP (%s) must be one of the vlans in the associated route domain (%s). For example: 192.168.0.1%1234 for self IP in route-domain 1234.
Location:
/var/log/ltm, console, and GUI.
Conditions:
When the self IP VLAN is not one of the VLANs in the route-domain, where the route domain is extracted based on the self IP address format.
Impact:
MCPD will prevent the self IP address from being created with the designated VLAN.
Recommended Action:
Verify that the route domain, as specified in the self IP address has the right VLANs as its members.
01070979 : The specified vlan (%s) for route domain (%s) is in use by a self IP.
Location:
/var/log/ltm
Conditions:
When attempting to remove a VLAN that still has a SelfIp association.
Impact:
VLAN is prevented from removal until the SelfIp in question is moved or removed.
Recommended Action:
Move the SelfIp(s) associated with the VLAN to other VLANs.
01070995 : get_tmstat: tmstat_sample not ready. Statsd may not be running.
Location:
/var/log/ltm
Conditions:
This warning message can appear while attempting to query statistics from a segment, subscribing to the segment directory fails. Typically this will occur if the statsd is not ready. Other less likely cases include a problem with resources, such as no memory available.
Impact:
Query of segment will fail.
Recommended Action:
In a typical case, the query can be retried when the statsd is ready. Then it succeeds. In the case of a resource problem, the statsd will need to be restarted.
01071027 : Master key OpenSSL error: %s
Location:
/var/log/ltm
Conditions:
These logs indicate that there is a problem with the BIG-IP device's secure vault feature, device group mutual authentication, or OpenSSL processing of those features. They come in two types.
These logs indicate a problem with openssl processing itself, such as an out-of-memory condition.
Master key OpenSSL error: Unit Key Generation fails!
Master key OpenSSL error: Key decrypt update
Master key OpenSSL error: Key decrypt final
Master key OpenSSL error: Master decrypt update
Master key OpenSSL error: Master decrypt final
Master key OpenSSL error: RSA public encrypt error
Master key OpenSSL error: b64_decode BIO_read error
Master key OpenSSL error: Cannot find proper algorithm
Master key OpenSSL error: Cannot create new X509 certificate
Master key OpenSSL error: Setting certificate version to SSL v3"
Master key OpenSSL error: Cannot allocate a pub_key type
Master key OpenSSL error: Cannot create new ASN1 type.
Master key OpenSSL error: Key size mismatch with PKCS1 padding size
Master key OpenSSL error: Cannot convert signature to data stream
Master key OpenSSL error: Error signing certificate
Master key OpenSSL error: Loading unit key: Error converting data blob to key.
Master key OpenSSL error: AES256 Symmetric Unit Key Generation fails!
These logs pertain to a corrupt master key, unit key, device group certs/keys, or HA certs/keys failures.
Master key OpenSSL error: Cannot open key store
Master key OpenSSL error: Cannot open key store RSA
Master key OpenSSL error: Cannot load %s (/.unit[1,2].key, /unit[1,2].crt, /master.[1,2], /master, /.unitkey, /temp, /master.recovery, /var/www/unitkeys/unit.crt)
Master key OpenSSL error: Cannot read master key
Master key OpenSSL error: Key encrypt
Master key OpenSSL error: Master encrypt
Master key OpenSSL error: Cannot save master key for peer.
Master key OpenSSL error: Symmetric Unit Key encrypt
Master key OpenSSL error: Symmmetric Unit Key decrypt
Master key OpenSSL error: Cannot open unit certificate file.
Master key OpenSSL error: Cannot read unit certificate file.
Master key OpenSSL error: Cannot write unit cert
Master key OpenSSL error: (/.unit[1,2].key, /unit[1,2].crt, /master.[1,2], /master, /.unitkey, /temp, /master.recovery, /var/www/unitkeys/unit.crt)
Master key OpenSSL error: Peer Certificate file
Impact:
Loading or syncing configurations with encrypted attributes will fail.
Recommended Action:
Reset the device trust group or the HA group. Or, reload a backup UCS file as described in K9420.
https://support.f5.com/csp/#/article/K9420
01071029 : %s
Location:
/var/log/ltm
Conditions:
1. These log messages pertain to the unit key and possible issues it may encounter.
Unit key SHA1 function failed.
Unit key hash does not match! Possible key corruption or tampering. Retry ...
Unit key read failed! Retry ...
Unit key read failed! back off to platform phase...
SecureVault encountered issue with reading Unit key from SEEPROM. Try rebooting the system...
Removing corrupt key header.
Cannot open unit key store
Unit key write to hal failed.
Unit key write verify failed.
Cannot load unit key
No Unit Key Found
Failed to encrypt the unit key
Loading unit key: Error converting data blob to key.
2. These log messages relate to the unit keys encryption of the master key:
Save Master Key aborted -- cannot load unit key.
Failed to encrypt the master key
save_master_key(master): Not ready to save yet -- no master key
save_master_key(master): Not ready to save yet -- no unit key
Couldn't retrieve the old master key.
Master Key not present.
Failed to encrypt the Master key
3. These log messages relate to attempts to change the master key.
Invalid master key
Attempted to rekey with a blank master key
Save Master Key aborted -- cannot determine unit id!
Cannot determine failover unit ID
4. This message is a general error.
b64_decode BIO_read error
5. This log message relates to the custom password db variable for encrypted attributes.
Custom Key not present. Please set the security.custompassword db variable.
Impact:
Possible issues using the secure vault feature.
Recommended Action:
1 and 2. Attempt to reboot the system. If the problem is not resolved, contact F5 support.
3. Attempt to change the key with a valid key.
4. None.
5. Set the security.custompassword db variable.
0107102d : Cannot load master key file. Updating to a new master key.
Location:
/var/log/ltm
Conditions:
The master key file does not exist or has been corrupted.
Impact:
Previous configurations with encrypted attributes using the old master key will be unloadable.
Recommended Action:
Upload a backup ucs file.
https://support.f5.com/csp/#/article/K9420
01071031 : %s
Location:
/var/log/ltm
Conditions:
When one of the system auth db variables SystemAuth.DisableRootLogin or SystemAuth.DisableBash is changed to "false" (turning off the security feature) or when the db variable SystemAuth.PrimaryAdminUser is modified, a message is logged indicating that a security setting has changed and the user account that made the change:
Security setting systemauth.disablerootlogin has been disabled by user admin
Security setting systemauth.disablebash has been disabled by user admin
Security setting systemauth.primaryadminuser has been modified from admin to newadmin by user admin
Impact:
None.
Recommended Action:
None.
01071038 : %s
Location:
/var/log/ltm
Conditions:
1. The following log entries occur during changes to the master key or aspects of the changing process.
Loading keys from the file.
Unit key read from the hardware.
Attempting Master Key migration to new unit key.
Master Key updated by user <user>
Unit key hash on write: <hash value>
Reloading the RSA unit to support config roll forward.
Read the unit key file if exists.
Loading master key from database object!
2. The following log entries relate to loading the unit key from the hardware, if these are different, there is an issue with the hardware.
Unit key hash from key header: <hash value>
Unit key hash computed from read key: <hash value>
3. The following log entries indicate that the master key is missing or corrupted:
Unable to load master key from database. Configuration object was null.
Unable to load master key from database. Empty master key attribute.
Unable to load master key from database. Master key decode fails.
Secondaries couldn't load master key from the file.
Secondaries couldn't load master key from the database.
Impact:
1. No impact.
2. Attempt rebooting the BIG-IP.
3. Recreate the master key
Recommended Action:
None.
01071047 : Removing %d %s local objects from slot %d
Location:
/var/log/ltm
Conditions:
mcpd logs this message in response to removing configuration objects associated with a chassis slot. This can happen as the result of a cluster member being disabled or going down. Interfaces and trunk working members, for example, which are associated with the cluster member are then removed.
Impact:
This is expected behavior. The removed configuration objects will be unavailable for a given slot until the blade has been restored.
Recommended Action:
None.
01071070 : Failed to %s file %s with error %d
Location:
/var/log/ltm
Conditions:
Mcpd logs this message in response to two events:
1. Failing to change permissions to read-only for file BigDB.dat
2. Failing to open file BigDB.dat
Both issues will be accompanied by an errno number. The first corresponds to the return value of chmod. The second corresponds to an error produced while attempting to construct an ofstream.
Impact:
The impact of failing to change permissions to read-only is that BigDB.dat can still be written to. This may be inconsequential, but it could also lead to unexpected behavior.
If mcpd fails to open BigDB.dat, it will throw an exception and core.
Recommended Action:
Unknown at this time. The workaround depends on what errno is given with the failure.
01071138 : The access policy (%s) has an action/macrocall item (%s) that is referenced by any rule's next item for %d time(s). Exactly one reference is allowed.
Location:
/var/log/ltm or TMSH
Conditions:
Access policy has incorrect topology. This might happen during access policy creation/modification by TMSH commands or script, at access policy import, or at configuration loading/verification.
Impact:
Access policy with incorrect topology is not created/modified.
Recommended Action:
If the message appears during access policy creation/modification by TMSH script, it is necessary to check the script used and correct it to exclude the invalid "next item" clause in API rules.
If the message appears during access policy import or configuration loading, there is no simple workaround. It is not recommended to try to use a broken configuration.
Manual editing of configuration files or exported access policy archive might be necessary, but it must not be done without explicit support recommendations.
01071246 : "Unable to reload the dns cache\n"
Location:
/var/log/ltm
Conditions:
This message can appear when dnscached failed to reload configuration files. Most likely that happens during the BIG-IP device startup, when dnscached is not started yet, but the command to reload configuration already executed.
Impact:
dnscached might have an invalid configuration or is not configured.
Recommended Action:
When the BIG-IP device is fully started, you can restart dnscached to reload the configuration:
tmsh modify sys db dns.cache value disable
tmsh modify sys db dns.cache value enable
To verify current status of dnscached, please use command:
tmsh list sys db dns.cache
010712a5 : Ha_group %s unknown %s %s.
Location:
/var/log/ltm, tmsh
Conditions:
The administrator has attempted to add a non-existent pool, trunk, or cluster object to an ha-group.
Impact:
The ha-group configuration is not modified.
Recommended Action:
Specify an existing pool, trunk, or cluster object for the HA group.
01071321 : Vlan allowed mismatch found: hypervisor (%s:%s), guest (%s:%s) and (%s:%s).
Location:
/var/log/ltm on a VCMP guest
Conditions:
A VLAN in a VCMP guest matches either the name or tag of a VCMP-host published VLAN. This usually happens when a VCMP-published VLAN is modified in the VCMP guest.
Impact:
This log message will appear in /var/log/ltm to advise a VCMP guest administrator about the mismatch.
Recommended Action:
Ensure that your VLAN configuration is as you expect, and consider modifying your VLAN configuration on either your host or your guest to resolve this error. Support usually recommends making VLAN changes on the VCMP host, which are then published to the VCMP guest in this case.
01071392 : Background command '%s' failed. %s
Location:
/var/log/ltm
Conditions:
Many components use this to execute a command. If the command fails, this message is logged for the command.
Impact:
Many components use this to execute a command. Actual impact depends on the command.
Recommended Action:
Many components use this to execute a command. A workaround might not be needed, or depends on the command.
Debug information might be obtained by setting mcpd's log level to info.
010713b1 : Cannot delete IP (%s) because it is used by the system state-mirroring (%s) setting.
Location:
/var/log/ltm, console, and GUI.
Conditions:
When trying to delete a self IP, but self IP is referenced in mirroring settings.
Impact:
Prevent the self IP from being deleted, until the mirroring setting no longer references the self IP.
Recommended Action:
Remove the self IP from the mirroring setting before trying to delete the self IP again.
010713b8 : Propose change to system hostname (%s).
Location:
/var/log/ltm
Conditions:
This message is logged by mcpd when vCMP hypervisor proposed a hostname change.
Impact:
None.
Recommended Action:
None.
010713ba : Propose change to default gateway (%s).
Location:
/var/log/ltm
Conditions:
This log message occurs on a VCMP guest when the VCMP guest starts, and when a user on the VCMP hypervisor changes the management gateway of the VCMP guest.
Impact:
None.
Recommended Action:
None.
010713bc : Propose change to management IP address (%s/%s).
Location:
/var/log/ltm
Conditions:
This message is logged on a VCMP guest when either of the following occurs:
1) When the VCMP guest starts
2) When a user on the VCMP hypervisor changes the management address of the VCMP guest.
Impact:
None. This log message is informational.
Recommended Action:
N/A
010713c0 : System state ready for hypervisor mgmt settings: (%s)
Location:
/var/log/ltm
Conditions:
This message is displayed during normal start-up on a VCMP guest when the VCMP guest received a management address or hostname from the VCMP host.
Impact:
This log message informs the user whether or not the VCMP guest is ready to install the management network and hostname config proposed by the VCMP host
Recommended Action:
None.
010713c1 : Initial management network proposals triggered (%s)
Location:
/var/log/ltm
Conditions:
Mcpd is initializing the hypervisor admin network settings. This generally happens upon system startup, re-licensing, or when the system status goes from down to up.
Impact:
There is no expected immediate impact of this message. The message merely indicates that mcpd has begun performing an operation and that there are no expected side effects until that operation is complete.
Recommended Action:
None.
010713c2 : No new proposal values detected
Location:
/var/log/ltm
Conditions:
Mcpd processed a message to update the settings for the admin network parameters or cluster floating interface (address, gateway address, or hostname), however, the message contained no new or changed information.
Impact:
No changes will be made to the admin network parameters or cluster floating interface.
Recommended Action:
If a change to the admin network parameters or cluster floating interface was intended, verify that the correctly changed information has been provided through the chosen configuration method.
010713c3 : Hypervisor updating %s. Old value: (%s) New value: (%s).
Location:
/var/log/ltm
Conditions:
This message is displayed during normal start-up on a VCMP guest when the VCMP guest received a management address or hostname from the VCMP host.
Impact:
The VCMP guest might install the proposed configuration depending on its current configuration.
Recommended Action:
None.
010713f6 : CentMgmt objects must be in the '/Common' folder
Location:
/var/log/ltm
Conditions:
Prior to version 11.1.0, using the cm device command to add a device to the system outside of devmgmtd.
Impact:
None.
Recommended Action:
None.
01071412 : Cannot delete IP (%s) because it is used by the system config-sync setting.
Location:
/var/log/ltm, console, and GUI.
Conditions:
When trying to delete a self IP, but self IP is referenced in config sync settings.
Impact:
Prevent the self IP from being deleted, until the config sync settings no longer reference the self IP.
Recommended Action:
Remove the self IP from the config sync setting before trying to delete the self IP again.
0107142f : Can't connect to CMI peer %s, %s
Location:
/var/log/ltm reports "Can't connect to CMI peer %s, %s"
tmsh show cm sync-status shows the connection state
tmsh prompt will show whether devices are connected. States include 'connected' or 'disconnected'.
Conditions:
Internal Conditions:
- socket failures, for example, create, setting socket options, failure to connect or poll on file descriptor.
- TMM on the local side has not yet established a listener (or failed to bind the socket)
External Conditions:
- The other device isn't ready, for example, the TMM on the other side hasn't been initialized to receive connections.
- General network failures (e.g. switch failure, cable failure, power outage, etc.)
Impact:
This generally is not a BIG-IP system error; it indicates external network failures. The BIG-IP will attempt to reconnect to peers till there's a successful connection.
Recommended Action:
This error is usually seen as a result of external network problems, but can be a symptom of internal problems such as mcpd running out of memory, the kernel running out of file descriptors, or mcpd restarting. This error is usually seen as a result of external network problems, but can be a symptom of internal problems such as mcpd running out of memory, the kernel running out of file descriptors, or mcpd restarting.
To check file descriptors: sysctl fs.file-nr
If mcpd runs out of memory or restarts, it should be logged in /var/log/ltm.
The config-sync connection uses port 6699, which is then routed and tunneled through tmm which establishes an ssl connection on port 4353 to the peer.
To check if the config sync listener exists and whether there are peer connections over the config-sync connection:
lsof -i | grep 6699
This should produce something like the following:
mcpd 6594 root 20u IPv6 1004016 TCP 10.20.0.1:6699 (LISTEN)
mcpd 6594 root 106u IPv6 1004433 TCP 10.20.0.1:6699->10.20.0.2:49485 (ESTABLISHED)
mcpd 6594 root 108u IPv6 1004454 TCP 10.20.0.1:40654->10.20.0.2:6699 (ESTABLISHED)
This indicates that the local BIG-IP has successfully created a listener, and is listening for peer connections, and that there are two connections for each peer device (one in each direction). This might help you determine which connection failed to connect.
To inspect the unencrypted CMI traffic on the BIG-IP:
tcpdump -nn -l -i <config sync vlan>:h port 6699
To check file descriptors: sysctl fs.file-nr
If mcpd runs out of memory or restarts, it should be logged in /var/log/ltm.
The config-sync connection uses port 6699, which is then routed and tunneled through tmm which establishes an ssl connection on port 4353 to the peer.
To check if the config sync listener exists and whether there are peer connections over the config-sync connection:
lsof -i | grep 6699
This should product something like the following:
mcpd 6594 root 20u IPv6 1004016 TCP 10.20.0.1:6699 (LISTEN)
mcpd 6594 root 106u IPv6 1004433 TCP 10.20.0.1:6699->10.20.0.2:49485 (ESTABLISHED)
mcpd 6594 root 108u IPv6 1004454 TCP 10.20.0.1:40654->10.20.0.2:6699 (ESTABLISHED)
This indicates that the local BIG-IP has successfully created a listener and is listening for peer connections and that there are two connections for each peer device (one in each direction). This may help you determine which connection failed to connect.
To inspect the unencrypted CMI traffic on the BIG-IP:
tcpdump -nn -l -i <config sync vlan>:h port 6699
01071430 : Cannot create CMI listener socket on address %s, port %d, %s
Location:
This will show in /var/log/ltm, and the CMI section of the prompt status will stay Disconnected.
Conditions:
Unable to create and bind the TCP connection used for listening to incoming CMI connections. The message will include strerror(3) output describing the problem.
Impact:
CMI will remain disconnected.
Recommended Action:
If the error string contains 'Cannot assign requested address', then ensure that a route exists to the remote device's configsync-ip.
01071431 : Attempting to connect to CMI peer %s port %d
Location:
/var/log/ltm
Conditions:
mcpd is starting up and attempting to set up a CMI connection to another device in the trust domain.
Impact:
This is not an error message. Other later messages will indicate whether this succeeded or failed.
Recommended Action:
None.
01071432 : CMI peer connection established to %s port %d after %d retries
Location:
/var/log/ltm
Conditions:
This device has successfully created a CMI connection to another device in the trust domain. This happens on mcpd startup or after a previous disconnection.
Impact:
This is not an error message. Configuration synchronization is now possible with the named device.
Recommended Action:
None.
01071434 : No CMI peer devices configured
Location:
/var/log/ltm
Conditions:
A device is in a DSC trust domain with other devices, but no config sync addresses have been configured.
Impact:
The device will be unable to connect to peers to sync configuration.
Recommended Action:
The user might be able to configure the configsync-ip on the local device to resolve the issue. If multiple devices are in this state, it might require the user to reset the trust on all of the devices, configure the configsync-ip individually, and then re-add the devices to the trust domain.
01071435 : Disconnecting from CMI peer %s as a result of a reconfiguration
Location:
/var/log/ltm
Conditions:
The CMI configuration has changed, requiring mcpd to intentionally disconnect from the named device. If it makes sense for the configuration change, it will attempt to reconnect shortly.
Impact:
If this happens because you removed a device from trust, there is no impact. If you modified the CMI configuration but left the device in place, you will not be able to sync the configuration until the device has reconnected.
Recommended Action:
None.
01071436 : CMI listener established at %s port %d
Location:
/var/log/ltm
Conditions:
mcpd is initializing and successfully created a listener that can accept incoming CMI connections.
Impact:
This is not an error message. This part of the system is healthy. mcpd can now accept incoming CMI connections.
Recommended Action:
None.
0107143a : CMI reconnect timer: %s
Location:
This message appears in /var/log/ltm, but only when mcpd debug logging is enabled.
Conditions:
There are two possible versions of this message.
The following message occurs when the device loses its CMI connection to at least one other device, and is starting up a timer to try reconnecting every five seconds:
CMI reconnect timer: enabled because at least one device is disconnected
Once the condition is cleared, the following message occurs to indicate that the reconnect timer is canceled:
CMI reconnect timer: disabled because all peers are connecting or connected
Impact:
mcpd is unable to make a CMI connection to at least one other device. The prompt status will also show as Disconnected.
Recommended Action:
Investigate why the connection is failing. The other device might either be unreachable or having an error of its own. Run 'show cm sync-status' to see exactly which device is disconnected.
0107143b : CMI connection debug info: %s
Location:
/var/log/ltm
Conditions:
MCPD log level is set to 'debug'. Debugging message related to CMI inter-device configuration synchronization. Usually this message indicates a change in state, such as a device connecting or disconnecting.
Impact:
Generally low. If the system is in an error state, a higher priority message will be logged at the same time.
Recommended Action:
None.
0107143c : Connection to CMI peer %s has been removed
Location:
/var/log/ltm
Conditions:
The CMI connection to another device has disconnected, either due to a problem with the other device or with the link itself.
Impact:
Synchable configuration will not be sent to the device in question until the connectivity problem is resolved.
Recommended Action:
If this is unexpected, inspect the log on the other process to determine what may be going wrong.
01071451 : Received CMI hello from %s
Location:
/var/log/ltm
Conditions:
Another device has established a CMI connection to this device.
Impact:
This is not an error message. CMI configuration sync will now be possible between the two devices.
Recommended Action:
None.
0107146f : Self-device %s address cannot reference the non-existent Self IP (%s); Create it in the /Common folder first.
Location:
/var/log/ltm, tmsh
Conditions:
The administrator has attempted to define a configsync or mirror-ip address that is not a valid self-ip.
Impact:
The operation fails and the address is not set.
Recommended Action:
Create the self-ip prior to using it as a configsync or mirror-ip address.
01071470 : Disconnecting from CMI device %s, the device is not in a trust domain
Location:
/var/log/ltm
Conditions:
This error occurs when another device attempts to create a CMI connection (that is, the mcpd for the additional device is starting up), and the device name it announces is unrecognized. This issue can occur if the device was removed from CMI while it was offline. Alternately, this error can occur if another device attempts to create a CMI connection, and there is no self device. During normal operation, this error is impossible.
Impact:
The BIG-IP system refuses to accept the connection. Sync will not occur, usually the expected behavior, because this message occurs if CMI was deconfigured on one device but the other devices were not informed.
Recommended Action:
Log on to the device attempting to connect, and remove it from its trust domain. Log on to any other devices in the trust domain and remove the device object. If desired, re-add the device to the trust domain.
0107147f : Could not read certificate file (%s)
Location:
This error message is displayed on the user interface, such as XUI or TMSH.
Conditions:
If you have scripts (such as iRule, CLI, APL or App Template scripts) and want to sign them for read-only protection, as part of the signing process, and the provided certificate cannot be read by BIG-IP system, this error message is displayed.
Impact:
When this message appears, verify that the certificate is correct and available before applying the signature.
Recommended Action:
When this message appears, verify that the certificate is correct and available before applying the signature.
01071485 : %s (%s) content does not match the signature.
Location:
/var/log/ltm, CLI, GUI
Conditions:
The signature on an AplScript, AppTemplate, CliShellScript, or iRule object does not match its contents.
Impact:
Configuration changes including the mismatched signature/content will be rejected.
Recommended Action:
None.
01071488 : Remote transaction for device group %s to commit id %llu %llu %s %llu failed with error %s
Location:
/var/log/ltm
Conditions:
This message occurs when this device sends a Config Sync to another device, and validation fails remotely on that device. This message includes another log message that provides more information.
This message indicates a legitimate misconfiguration, and provides an action to take that is related to the synchronized objects.
One common example applies to a floating self IP. The self IP object is required to name a VLAN on which it listens. A VLAN of the same name must exist on the other device, as well.
Impact:
The remote device aborted the Config Sync transaction, and did not acquire any of its changes.
Recommended Action:
This message can include a more specific error, which you can reference in the error catalog for resolution.
0107149c : Virtual server %s has more than one clientssl/serverssl profile but none of them is default for SNI.
Location:
/var/log/ltm
Conditions:
The virtual server is configured to securely host (such as through HTTPS) multiple DNS hostnames, but none of the profiles are the default, and the virtual server configuration has unchecked the "Require Peer SNI Support", thereby permitting client connections not using SNI support.
This is an error because a default profile is required to identify the SSL certificate to be provided from the virtual server to the client when an incoming client connection requests an unrecognized hostname, or when the client does not support the Server Name Identification extension (SNI, RFC 4366) to the TLS protocol.
Impact:
The virtual server configuration fails to load, and the virtual server is unavailable.
Recommended Action:
User should configure the server to select a default SSL profile for SNI, for each of one Client SSL profile and one Server SLL profile, or enable the feature to, 'Require Peer SNI support'. The configuration should then load successfully (a reboot is not required).
010714a0 : Sync of device group %s to commit id %llu %llu %s %llu from device %s complete
Location:
/var/log/ltm
Conditions:
The mcpd log level is set to 'notice' or 'debug', a device is in a trust domain with at least one other peer, and the peer synced a device group.
Impact:
The local device has updated the last sync information of the peer for a particular device group.
Recommended Action:
Set the db variable log.mcpd.level to 'notice' or any other more restrictive level.
01071515 : Unclassified domain logging on %s requires log publisher to be set.
Location:
tmsh, GUI
Conditions:
When configuring Unclassified domain logging in a classification profile, without any log profile assigned to classification profile.
Impact:
Unclassified domain logging is not available through classification HSL.
Recommended Action:
Attach log profile to classification profile.
01071528 : Device group '%s' sync inconsistent, %s.
Location:
/var/log/ltm, tmsh
Conditions:
This can be reported via:
"tmsh show /cm sync-status"
A device is in a DSC device group and a configuration sync failed.
Impact:
The configuration is unable to propagate to the peer.
Recommended Action:
There should be additional information in the message to indicate why the sync failed. There may also be additional logs in /var/log/ltm.
See also: tmsh show /cm sync-status
01071539 : Mcpd is starting. The BIG-IP version is %s
Location:
/var/log/ltm
Conditions:
mcpd is starting. This happens as a normal result of restarting the daemon or simply first time boot.
Impact:
This is normal and expected behavior. Mcpd should begin to progress through initialization phases.
Recommended Action:
None.
01071587 : Commit ID message ignored, %s
Location:
/var/log/ltm
Conditions:
This message occurs when a device receives a commit ID update (that is, a config change) from a peer, but the commit ID is missing the originator field.
Impact:
No known negative impact.
Recommended Action:
To examine the commit IDs from a peer, you can run tmsh run /cm sniff-updates.
010715bc : "The application service (%s) has strict updates enabled, the object (%s) must be updated using an application management interface."
Location:
GUI, CLI
Conditions:
An application service has strict updates enabled, and you are trying to manage associated objects outside of the application management interface.
Impact:
Any changes that you make directly to objects associated with the application service will be lost.
Recommended Action:
Update the objects through the iApp menu in the BIG-IP Configuration utility or through the tmsh sys appplication service. An alternative is to access the application service through the iApp menu, view the advanced properties, and disable strict updates for the service so that you can manage associated objects directly. However, if you use the iApp to make changes later, the changes that you made directly will be lost.
01071653 : Failed to create the (%s). The maximum allowable length of %d for name has been exceeded. The object name was (%s).
Location:
/var/log/ltm, GUI, CLI
Conditions:
Attempt to create a TSIG key, Nameserver, or Cache with a name containing more than 255 characters.
Impact:
The TSIG key, Nameserver, or Cache is not created.
Recommended Action:
When creating TSIG key, Nameserver, or Cache, make sure the length of the name is within 255 characters.
0107167d : Data publisher not found or not implemented when processing request %s.
Location:
/var/log/ltm
Conditions:
Possible causes of this error include:
- Statsd daemon might not be running yet.
- Mcpd received a bad request.
- A stats publisher is not available to handle the request.
Impact:
Impact can potentially include:
- No stats available.
- Certain requests are not be processed by Mcpd.
Recommended Action:
(1) Ensure that statsd daemon is running. `bigstart status statsd merged`
(2) Ensure that the publishing daemon is running. For example, if the error is logged when you run `tmsh show net arp`, determine whether the TMM is up by running `bigstart status tmm`.
If any of the daemons are down, run `bigstart start <daemon>`.
If all daemons are running, then neither of the two cited daemons is the cause. Instead, the cause might be an internal issue related to a malformed request, in which case you should file a support ticket.
01071681 : SNMP_TRAP: Virtual %s has become available
Location:
/var/log/ltm
Conditions:
This message is logged when the virtual server becomes "available", transitioning from some other status. Note that this indicates the virtual server is now "status-green", transitioning from some other status such as "unchecked-blue" or "unavailable-red".
Impact:
This message is log-notification only when the virtual server status is changed to be available (status "green"). This is not an error, as this virtual server is established as correctly configured to receive new client connections.
Recommended Action:
This is not an error, but a notification of a virtual server status change that has now become available.
01071682 : SNMP_TRAP: Virtual %s has become unavailable
Location:
/var/log/ltm
Conditions:
Example:
SNMP_TRAP: Virtual my_server has become unavailable
This message is logged when the virtual server becomes "unavailable", transitioning from some other status. Note that this indicates the virtual server is now "status-red", transitioning from some other status such as "available-green" or "unchecked-blue".
Impact:
This message is log-notification only when the virtual server status is changed to be unavailable (status "red"). Because the virtual server is unavailable, no new client connections will be established to this virtual server.
Recommended Action:
This is a notification of a virtual server status change for a virtual server has now become unavailable. The unavailable-status (i.e., "red") might be an indication of an error, such as when the required number of pool members are unavailable due to configuration error or one-or-more pool member failures.
0107168c : Incremental sync complete: This system is updating the configuration on device group %s device %s from commit id { %llu %llu %s } to commit id { %llu %llu %s }.
Location:
/var/log/ltm
Conditions:
A device in a DSC device group is able to successfully construct an incremental sync message requested by a peer.
Impact:
This is information about a successful operation.
Recommended Action:
None.
0107168e : Unable to do incremental sync, reverting to full load for device group %s device %s from commit id { %llu %llu %s } to commit id { %llu %llu %s }.
Location:
/var/log/ltm
Conditions:
The device is in a DSC device group with incremental sync enabled.
If a peer device requests an incremental sync, and the local device is unable to reconstruct the series of incremental syncs out of the sync cache from the commit_id specified by the peer, it will revert to a full sync.
This usually occurs because the cache is full and prior commit_id transactions have been dropped to make space.
The cache can be inspected by an Administrator via:
tmsh show cm device-group <device group name> incremental-config-sync-cache
The size of the cache can be set/checked per device group:
tmsh list cm device-group <device group name> incremental-config-sync-size-max
Impact:
Syncing may take a longer to complete. If automatic syncing is enabled, and many changes are made to configuration in the device group, this could cause mcpd to become unresponsive and in extreme cases run out of memory and core.
Recommended Action:
If a user is seeing this message, it's recommended to increase the size of the incremental sync cache and/or reduce the size and frequency of config changes.
010716b3 : A draft policy (%s) can not be applied to ACL rule (%s).
Location:
/var/log/ltm
Conditions:
An unpublished L7 policy is being assigned to an AFM ACL rule.
Impact:
Configuration validation, no impact.
Recommended Action:
Publish the L7 policy before assigning it to the AFM ACL rule.
010716b4 : Policy %s cannot be assigned to %s, because %s.
Location:
/var/log/ltm
Conditions:
An L7 policy is not compatible with a destination object, for example, when a non-classification policy is being assigned to an AFM ACL rule.
Impact:
Preventive configuration validation, no impact.
Recommended Action:
Attach only compatible L7 policies to a destination object.
010716e3 : Policy '%s'; an action precedes conditions in another rule.
Location:
/var/log/ltm
Conditions:
A Best-Match CPM policy has an action in one or more of its rules that is not guaranteed to follow a condition in one or more rules. (The rules containing the action and condition may be different.)
Impact:
The policy will not load.
Recommended Action:
Change the Best-Match policy so that the actions occur in events that are compatible with the conditions. Actions must always occur after conditions.
If action events are not guaranteed to follow conditions, then a programatic solution is available via iRules. The situation where the action's event is encountered before the condition event can be handled in an arbitrary way by the iRule.
0107172d : Policy '%s' can't be applied to virtual server '%s' because it has no rules
Location:
The error message is visible in the web user interface, TMSH/CLI console, and the LTM log (/var/log/ltm).
Conditions:
The error message is triggered by the attempt of a user driven action to create or modify an LTM policy without specifying policy rules.
Impact:
Directing the user to create or modify an LTM policy within the required validation conditions, in this case by specifying policy rules for the LTM policy.
Recommended Action:
The user action should follow the correct steps while creating or modifying an LTM policy, by adding at least a validation rule to the LTM policy.
01071764 : HA order list in traffic group (%s) cleared because there is no self failover device group.
Location:
/var/log/ltm
Conditions:
When a device is no longer a member of a sync-failover group, any ha-order list specified for any traffic group is automatically cleared.
Impact:
None. Expected behavior because of a configuration change.
Recommended Action:
None.
0107179a : Setting DB variable %s to %s. Reboot is required for changes to take effect.
Location:
/var/log/ltm
Conditions:
On a BIG-IP non-Virtual Edition (VE) device or hardware device that does not have a FIPS 140-2 Level 1 license, a FIPS 140-2 Level 1 license has been procured and installed.
-- BIG-IP non-VE or hardware device does not have a FIPS 140-2 Level 1 license.
-- A FIPS 140-2 Level 1 license is procured and installed.
-- The prompt changes to 'REBOOT REQUIRED'.
Impact:
The system prompt changes to 'REBOOT REQUIRED'. The device must be rebooted for the new license settings to take effect.
Recommended Action:
None.
010717b3 : Setting DHCP request-option to none can result in management-ip misconfiguration and loss of management connectivity.
Location:
/var/log/ltm
Conditions:
- Using DHCP to configure management-ip, management-route, DNS, hostname, etc. in a BIG-IP.
- Setting DHCP request-option to none using "tmsh modify sys management-dhcp sys-mgmt-dhcp-config request-options none".
Impact:
As request-options specify the management options that a dhclient running on BIG-IP device requests from the dhcp server in the network, setting request-options to none could result in a BIG-IP device not receiving any configuration (mgmt-ip, mgmt route, dns etc) crucial for management connectivity.
Recommended Action:
DHCP servers can be configured with "authoritative" setting, in which case, it would always provide dhclient with a fixed set of configuration, even if it receives an empty request-options list from dhclient.
010717b6 : %s can only be used in one LSN pool or security nat source translation object. The PCP Server %s (%s) is in use by lsn pool %s.
Location:
GUI, CLI
Conditions:
If PCP Server is already in use by one of the LSN Pools for FW NAT Source translation objects and the user is configuring the same PCP server on another LSN Pool or FW NAT source translation object, user will see this MCP validation error.
Impact:
Creation/Modificaton of the LSN Pool or FW NAT Source translation object would fail unless the user modifies the PCP server field.
Recommended Action:
None.
010717dc : VXLAN tunnel remote address can be configured only as any(0.0.0.0) with flooding types none and multipoint.
Location:
GUI, /var/log/ltm
Conditions:
When configuring a non-multicast VXLAN tunnel in which the tunnel remote-address is set to non-zero address.
Impact:
MCP validation blocks this improper configuration for non-multicast VXLAN tunnels and displays this error message.
Recommended Action:
For non-multicast VXLAN tunnels, the user has to set the tunnel remote-address to 'any' (0.0.0.0).
010717e2 : Client SSL profile (%s): must have at least one set of %s.
Location:
/var/log/ltm
Conditions:
The user has configured a Client SSL profile improperly.
Impact:
The profile configuration does not specify a certificate/key pair, and is therefore disallowed.
Recommended Action:
Specify a certificate/key pair in the Client SSL profile configuration.
0107183b : Cannot disable LDNS cache when a Wide IP has persistence enabled.
Location:
/var/log/ltm
Conditions:
During a GTM configuration load or while processing a configuration modification, MCPD received a message to set the LDNS cache to disabled but there exists at least one wideip that has persistence enabled.
Impact:
The LDNS cache is required for wideip persistence, therefore MCPD will set the LDNS cache to enabled.
Recommended Action:
The LDNS cache must be enabled for wideip persistence to function; therefore, it is advised that either wideip persistence must be disabled or the LDNS cache must remain enabled.
The following tmsh command will disable persistence for all wideips of the specified record type:
tmsh modify gtm wideip <wideip_record_type> all persistence disabled
01071860 : Cannot enable feed list %s. Maximum number of enabled feed list allowed is %d.
Location:
log/UI/TMSH, GUI
Conditions:
When trying to enable more than 8 urldb feedlist entries for custom url categorization.
Impact:
Only the first 8 feedlist entries will work.
Recommended Action:
Remove one or more feedlist entries from 8 already enabled feedlist entries, if a new one is needed.
01071863 : OCSP cert-validator (%s): DNS resolver and proxy server pool can not be both empty.
Location:
/var/log/ltm, tmsh console, iControl, GUI
Conditions:
The user is trying to create an OCSP cert-validator, but assigning neither a DNS resolver nor a proxy server pool to the OCSP validator.
Impact:
None.
Recommended Action:
Specify either a DNS resolver or a proxy server pool for the OCSP cert-validator.
01071864 : OCSP cert-validator (%s): The certificate (%s) can not be used by an OCSP cert-validator as a %s, because it is currently using some cert-validator (%s) to monitor its status.
Location:
/var/log/ltm
Conditions:
The error message is not being used.
Impact:
None.
Recommended Action:
None.
01071865 : Unable to find an HTTP-based OCSP responder URL that is configured in the OCSP cert-validator (%s) or in the AIA (Authority Information Access) extension of the certificate (%s).
Location:
/var/log/ltm, tmsh console, iControl, GUI
Conditions:
An OCSP validator is assigned to a certificate, but no OCSP responder URL is found in either the OCSP validator's configuration or the certificate's AIA (Authority Information Access) extension.
Impact:
None.
Recommended Action:
Either configure the OCSP responder URL for the OCSP validator, or use a certificate that contains the AIA extension that specifies the OCSP responder's URL.
01071866 : OCSP cert-validator (%s): Please specify a HTTP-based absolute URL for the OCSP responder.
Location:
/var/log/ltm, tmsh console, iControl, GUI
Conditions:
The user is trying to configure an invalid URL address (not starting with http://) as the responder URL of an OCSP cert-validator.
Impact:
None.
Recommended Action:
Configure an OCSP responder URL to the OCSP cert-validator that starts with "http://".
01071867 : OCSP cert-validator (%s): Both key and certificate should be specified for signing the OCSP request.
Location:
/var/log/ltm, tmsh console, iControl, GUI
Conditions:
The user is trying to configure only the signer key (without a signer certificate) or only the signer certificate (without a signer key) to an OCSP cert-validator. Signer key and certificate should come as a pair.
Impact:
None.
Recommended Action:
Either specify both key and certificate, or specify none of them.
01071868 : OCSP cert-validator (%s): Only prime256v1 named curve is supported for signer key.
Location:
/var/log/ltm, tmsh console, iControl, GUI
Conditions:
The signer key of the OCSP validator is an EC (elliptic curve) key with an unsupported curve type (the only supported curve is prime256v1).
Impact:
None.
Recommended Action:
If the signer key is an EC (elliptic curve) key, make sure that its curve type is prime256v1.
01071869 : OCSP cert-validator (%s): Security type %s is not supported for signer key.
Location:
/var/log/ltm, tmsh console, iControl, GUI
Conditions:
The user is trying to configure a signer key to an OCSP validator, but the key type of the signer key is not supported.
Impact:
None.
Recommended Action:
The security type of the key can be obtained by "tmsh list sys crypto key". Currently fips and nethsm types are not supported.
0107186a : OCSP cert-validator (%s): Signer key (%s) and signer certificate (%s) do not match.
Location:
/var/log/ltm, tmsh console, iControl, GUI
Conditions:
The signer key and signer certificate that the user is configuring for the OCSP cert-validator don't match.
Impact:
None.
Recommended Action:
Make sure that the key and certificate match each other. If not, try to get a correct key/certificate pair.
010718e1 : Only the standard-balanced-fpga firmware type is permitted in vCMP mode.
Location:
tmsh, GUI, iControl, /var/log/ltm
Conditions:
Provisioning VCMP or changing the FPGA.
Impact:
User is forced to only use standard-balanced-fpga when using VCMP.
Recommended Action:
Make sure the FPGA is set to standard-balanced-fpga when using VCMP.
010718e3 : Certificate (%s) has enabled OCSP at cert-validation-option but is not associated with any OCSP cert-validator.
Location:
/var/log/ltm, tmsh console, iControl, GUI
Conditions:
The user is trying to enable OCSP monitoring for a certificate that has no OCSP validator assigned.
Impact:
None.
Recommended Action:
Assign an OCSP validator to the certificate first, and then enable the OCSP monitoring for the certificate.
010718e4 : OCSP cert-validator (%s): can not use both DNS resolver and proxy server pool. Please ensure that only one of them is configured.
Location:
/var/log/ltm, tmsh console, iControl, GUI
Conditions:
The user is trying to create an OCSP cert-validator, but assigning both of DNS resolver and proxy server pool to the OCSP validator.
Impact:
None.
Recommended Action:
Remove either the DNS resolver or proxy server pool from the OCSP cert-validator.
01071909 : Anti-Fraud publisher '%s' is required to be with one destination of type '%s'.
Location:
TMSH, GUI
Conditions:
Trying to delete a publisher used by Anti-Fraud, or trying to set a publisher with wrong destination type.
Impact:
Configuration will fail.
Recommended Action:
Detach publisher from Anti-Fraud profile prior publisher removal. Set a publisher with the correct destination type.
0107190a : Field '%s' cannot be empty in the Anti-Fraud profile '%s'.
Location:
/var/log/ltm, GUI, and console
Conditions:
An empty field was specified while configuring an Anti-Fraud profile.
Impact:
Configuration will not be applied.
Recommended Action:
Specify a non-empty field.
01071911 : %s in rule (%s) are not allowed under %s event on the %s (%s).
Location:
/var/log/ltm, GUI
Conditions:
This is an error that is issued when MCPD is validating iRule proc with the current configuration and detecting an incompatibility.
This scenario is most likely involves the user creating a library of nested reusable iRule procs that are meant to be called from multiple event based iRules and other procs, and then combining one or more iRules with these procs by associating them with the virtual server in order to achieve the desired behavior. One or more of of the rules invoking functionality in the procs does so in under the wrong event.
For example, an iRule proc might attempt to return an application specific combination of HTTP headers, including the host header:
# user creates virtual
ltm virtual vs_http {
destination any:80
profiles {
http {}
tcp {}
}
...
}
# user creates rule in ltm rule /Common/rl_app_http
proc get_app_host_headers { } {
return "[HTTP::header app_1]-[HTTP::host]"
}
proc get_app_headers { } {
return "[call get_app_host_headers]-[HTTP::host]"
}
this code may then be called from an iRule event in
# in ltm rule /Common/rl_http_req
when HTTP_RESPONSE {
set app_h [call rl_app_http::get_app_host_headers]
}
# Error is issued by validation code upon saving since HTTP::host is not valid under HTTP_RESPONSE
Impact:
Saving the modified configuration will not be possible.
The virtual server configuration or iRules need to be corrected before saving the configuration will be possible.
Recommended Action:
Users need to ensure that the correct combination of iRule commands and events is associated with the virtual server by performing one of the steps:
1. Associate the right profile(s) with the virtual server.
2. Use only applicable commands in iRule procs.
3. Ensure that the combination of events in iRules and commands is still valid when modifying virtual server configuration.
01071912 : %s in rule (%s) requires an associated %s profile on the %s (%s).
Location:
/var/log/ltm
Conditions:
A an iRule script was added to a virtual that referred to a configuration object (like pool, snat pool, transport-congig, etc). When this iRule script was added to a virtual or transport-config, the validation logic identified that the referred object would not be present unless the named profile existed on the virtual or transport-config.
Impact:
There should be no impact. The validation logic checks the configuration to insure the script will run properly.
Recommended Action:
Remove the reference to the named object and add the script to the virtual or transport-config.
01071913 : %s in rule (%s) under %s event at %s (%s) does not satisfy cmd/event/profile requirement.
Location:
/var/log/ltm and GUI
Conditions:
This is an error that is issued when MCPD is validating iRule proc with the current configuration and detecting an incompatibility.
This scenario is most likely involving the user creating a library of reusable iRule procs that are meant to be called from multiple event based iRules, and then combining one or more iRules with these procs by associating them with the virtual server in order to achieve the desired behavior. The user then decides to remove a profile deemed unnecessary from the virtual.
However, the combination of virtual server, the iRule event that leads to calling the proc and the commands executed in the iRule proc itself, might lead to incompatible combination.
For example, an iRule proc might attempt to return an application specific combination of HTTP headers:
# user creates virtual
ltm virtual vs_http {
destination any:80
profiles {
http {}
tcp {}
}
...
}
# user creates rule in ltm rule /Common/rl_app_http
proc get_app_headers { } {
return "[HTTP::header app_1]-[HTTP::header app_2]"
}
this code may then be called from an iRule event in
# in ltm rule /Common/rl_http_req
when HTTP_REQUEST {
set app_h [call rl_app_http::get_app_headers]
}
# user then decides to remove http profile from the virtual server
... (tmos)# mod ltm virtual vs_http profiles delete { http } <ENTER>
# Error is issued by validation code
Impact:
Saving the modified configuration will not be possible.
The virtual server configuration or iRules need to be corrected before saving the
configuration will be possible.
Recommended Action:
Users need to ensure that the correct combination of iRule commands and events is associated with the virtual server by performing one of the steps below:
1. Associate the right profile(s) with the virtual server
2. Use only applicable commands in iRule procs
3. Ensure the combination of events in iRules and commands is still valid when modifying
virtual server configuration
01071918 : CMI device (%s) has a different version (%s) from this device (%s).
Location:
/var/log/ltm
Conditions:
Another device attempts to make a CMI connection to this device, but reports that it has a different version of TMOS than this device.
This message will show up during the process of upgrading a CMI trust domain from one version of TMOS to a later one.
Impact:
CMI sync between devices of different versions is not supported.
Recommended Action:
This message usually will show up during the process of upgrading a CMI trust domain from one version of TMOS to a later one. Once all devices are upgraded to the new TMOS version, they will be able to connect to each other.
010719a8 : URL parameters can be %s only when %s is enabled in the Anti-Fraud profile '%s'.
Location:
mcpd, tmsh console, GUI
Conditions:
Parameter's flag is dependent on URL flag. (in order to enable Parameter's flag 'A', URL's flag 'B' must be enabled).
Impact:
Parameter's flag won't be set.
Recommended Action:
Enable the dependent flags.
010719ac : Parameter cannot be %s while it is %s in the Anti-Fraud profile '%s'.
Location:
mcpd, tmsh console, GUI
Conditions:
A mobilesafe parameter is marked as encrypted, and the user want's to mark it as enforced (entangled).
OR
A mobilesafe parameter is marked as enforced, and the user want's to mark it as encrypted.
Impact:
Parameter remains with original flag enabled.
Recommended Action:
Enable either "encrypted" or "enforced", but not both.
010719b7 : URL whitelist words can be selected only from malware blacklist words in the Anti-Fraud profile '%s'.
Location:
mcpd, tmsh console, GUI
Conditions:
Setting a whitelist word that isn't configured in blacklist words (of the same profile).
Impact:
The mcp transaction aborted. Malware object is not changed.
Recommended Action:
Add whitelist words only if they are configured in blacklist words (of the same profile).
010719b7 : Anti-Fraud DOM signature '%s'(hash ID) cannot be deleted as it appears in the DOM signatures whitelist in the Anti-Fraud profile '%s' (Anti-Fraud URL: '%s').
Location:
/var/log/ltm, GUI, CLI
Conditions:
A user has attempted to delete an Anti-Fraud DOM signature that appears in a DOM signatures whitelist. The whitelist is in a URL in the Anti-Fraud profile.
Impact:
The Anti-Fraud DOM signature is not deleted.
Recommended Action:
If an Anti-Fraud DOM signature needs to be deleted, then before deleting it,
remove it from all DOM signatures whitelists that it appears in.
010719c9 : Unicast address warning (FAILOVER MAY NOT WORK): %s should be a mgmt (blade) address or non-floating self IP.
Location:
/var/log/ltm
Conditions:
The address does not seem to be valid with the information present in the local box, but may still be valid based on the configuration of the network.
Impact:
Verify the unicast address to make sure there is not a configuration error.
Recommended Action:
None.
010719d6 : The location '%s' cannot have empty path between leading '/' and file extension or trailing '/', and also cannot contain only '/' and '.' in the Anti-Fraud profile '%s'.
Location:
mcpd, tmsh console, GUI
Conditions:
Setting invalid location (empty or contains only '/' and '.' characters).
Impact:
The mcp transaction aborted. Changes will not take effect.
Recommended Action:
Set valid locations only (non-empty, containing alphanumeric characters).
010719e7 : Virtual Address %s general status changed from %s to %s.
Location:
/var/log/ltm
Conditions:
Example:
Virtual Address my_server general status changed from YELLOW to GREEN.
This message is logged when a general status change is detected for the virtual address. Possible general statuses for a virtual address include: 'GREEN', 'YELLOW', 'RED', 'BLUE', 'GRAY'.
The general status for a virtual address typically depends on one-or-more pool members, and the associated configuration of the virtual address itself. For example, a pool of four members might be associated with a virtual address, and require a minimum of two pool members to be available for the virtual address to be marked up (that is, "GREEN"). Thus, the conditions for a change in the general status of the virtual address include a combination of the virtual address configuration, plus the health of the contributing pool members.
Impact:
This message might not indicate an error, because it merely reports the detected general status change. For example, upon system start, it is expected that the general status might change from "BLUE" (unchecked) to "GREEN" (available). Similarly, user-action (such as through xui or tmsh) might explicitly change the general status, such as to "GRAY" when forcing the virtual address to be unavailable during maintenance.
Recommended Action:
This message might not indicate an error, but a notification of a virtual address general status change, due to monitor results or user-initiated action. If an unexpected "RED" status is reported, the user should verify the virtual address configuration, and the availability of the contributing pool members.
010719e8 : Virtual Address %s monitor status changed from %s to %s.
Location:
/var/log/ltm
Conditions:
Example:
Virtual Address my_name monitor status changed from CHECKING to UP.
This message is logged when a status change is detected for a virtual address. Possible statuses include: "UNCHECKED", "CHECKING", "INBAND", "FORCED_UP", "UP", "UP_MAX", "DOWN_MIN", "ADDR_DOWN", "DOWN", "FORCED_DOWN", "MAINT", "IRULE_DOWN", "INBAND_DOWN", "DOWN_WAIT_MAN_RES".
Impact:
This message might not itself indicate an error, as it merely reports the detected status change. For example, upon system start it is expected that the status might change from "UNCHECKED" to "CHECKING" to "UP". Similarly, user action (such as through the xui or tmsh) might explicitly change the status, for example, to "FORCED_DOWN".
However, an unexpected "DOWN" status not resulting from intentional user-initiated action might indicate an issue, such as a failed resource or an improperly configured virtual address.
Recommended Action:
This message might not itself indicate an error, but a notification of a virtual address status change, due to monitor results or user-initiated action. If an unexpected "DOWN" status is reported, the user should verify that the virtual address is available and ensure correct monitor configuration.
010719ea : GTM changed state from %s to %s.
Location:
/var/log/ltm
Conditions:
Example:
notice reported: notice mcpd[7345]: 010719ea:5: GTM changed state from UP to DOWN.
This message is not an error by itself, only a notice.
It only means that the GTM module went from UP to DOWN or vice versa.
If the message shows up repeatedly in the logs, this could mean that something else is wrong with the system and the user should look for additional clues as to why this is happening.
Impact:
"GTM changed state from UP to DOWN" means that the gtmd daemon went offline, while offline GTM functionalities will not be available.
"GTM changed state from DOWN to UP" means that the gtmd daemon went online, while online GTM functionalities are available.
Recommended Action:
If GTM is DOWN, the user can bring the daemon back online with the command "bigstart start gtmd", "bigstart stop gtmd" to take it offline. If that does not work, the user should investigate further as to why the daemon is going offline or refusing to come online.
010719fd : No IPv%s self IP exists on VLAN (%s) for static route (%s)
Location:
/var/log/ltm
Conditions:
The last IPv4 or IPv6 self IP was deleted from a VLAN, which will leave a static route without an IP on the egress VLAN.
Impact:
The self IP cannot be deleted until the static route is deleted or its nexthop is changed to use a different VLAN.
Recommended Action:
Before deleting the last IPv4 or IPv6 self IP from a VLAN, delete static routes for that protocol that use the VLAN.
01071a01 : URL parameters can appear only in POST request when Mobile encryption is enabled in the Anti-Fraud profile '%s'.
Location:
mcpd, tmsh console, GUI
Conditions:
Trying to set a Mobilesafe parameter to GET method.
Impact:
The transaction aborted. No change to parameter.
Recommended Action:
Either disable mobilesafe encryption, or declare mobilesafe parameter for POST method only.
01071a14 : device_trust_group: Requesting device data from device %s.
Location:
/var/log/ltm
Conditions:
When the local device requests device-specific data from the remote device. This usually happens when the remote device has changed something in its device data, and the local device needs to sync this information.
Impact:
None.
Recommended Action:
None.
01071a15 : device_trust_group: Sending device data to device %s.
Location:
/var/log/ltm
Conditions:
Information that a device is sending its device-specific trust data to the remote device that requested it.
Impact:
None.
Recommended Action:
None.
01071a37 : Anti-Fraud %s '%s' was created as %s and this setting cannot be changed.
Location:
/var/log/ltm
Conditions:
Attempting to change the type of an Anti-Fraud URL or parameter from explicit to wildcard and vice-versa.
Impact:
Configuration will not load.
Recommended Action:
Do not change the type of an Anti-Fraud URL or parameter. Delete item and recreate it with the desired type instead.
01071a38 : Wildcard %ss must have unique priorities in the Anti-Fraud profile '%s'.
Location:
/var/log/ltm
Conditions:
Attempting to assign identical priorities to wildcard URLs or parameters in an Anti-Fraud profile.
Impact:
Configuration will not load.
Recommended Action:
Verify priorities are unique among wildcard URLs or parameters in an Anti-Fraud profile.
01071a39 : Cannot %s of explicit %s in the Anti-Fraud profile '%s'.
Location:
/var/log/ltm
Conditions:
Attempting to edit priority of explicit URL or parameter in an Anti-Fraud profile.
Impact:
Configuration will not load.
Recommended Action:
Do not edit priority of an explicit URL or parameter.
01071a6e : Incompatible options - traffic group %s cannot have both auto-failback-enabled and the failover-method set to ha-score
Location:
/var/log/ltm, console
Conditions:
When a user tries to set both parameters for a traffic-group.
Impact:
The command will not be executed.
Recommended Action:
None.
01071a85 : Wildcard URL cannot have %s enabled in the Anti-Fraud profile '%s'.
Location:
mcpd, tmsh console, GUI
Conditions:
Trying to set mutual exclusive flags (that is, wildcard + mobilesafe encryption).
Impact:
The mcp transaction aborted. No change will be made to URL object.
Recommended Action:
Do not try to set mutual exclusive flags.
01071a95 : Admin IP (%s/%s): Gateway (%s) for management route (%s) is not in a connected network.
Location:
/var/log/ltm
Conditions:
When the user creates a management-ip that is not on the same subnet as the management-route, an error message is added to /var/log/ltm.
This validation error message is to help the user to prevent leaving a stray management gateway configured.
Impact:
None.
Recommended Action:
Delete the stray management-route and add a new one that matches the management-ip.
01071a9a : The '%s' for interface %s has been adjusted to '%s'.
Location:
/var/log/ltm
Conditions:
The bundle status and bundle speed attributes of each interface are detected when the system boots up, based on the type of physical ports.
For ports that support the bundle feature, the two attributes have to be updated to reflect the run time values.
A notice is logged into the /var/log/ltm to notify the user of this update.
Impact:
None.
Recommended Action:
None.
01071aa6 : %s bad actor cannot be enabled if per-source detection/limit pps is less than 1% of the DoS vector (%s) %s setting for %s.
Location:
/var/log/ltm
Conditions:
The per-source detection/limit pps is less than 1 percent of the corresponding value of the DoS vector. The Dos vector is specified by the configuration value of the rate threshold/rate limit in the DoS vector.
Impact:
Security DoS DNS/SIP/NETWORK/Device attack vector bad actor cannot be enabled.
Recommended Action:
Change the configuration settings of the DoS attack vector for either per-source detection/limit pps or rate threshold/rate limit.
01071aa7 : %s bad actor per-source detection/limit pps cannot be greater than the Dos vector (%s) %s setting for %s.
Location:
/var/log/ltm
Conditions:
The per-source detection/limit pps is greater than the corresponding value of the DoS vector. The DoS vector is specified by the configuration value of the rate threshold/rate limit in the DoS vector.
Impact:
The security DoS DNS/SIP/NETWORK/Device attack vector bad actor cannot be enabled.
Recommended Action:
Change the configuration settings of attack vector for either the per-source detection/limit pps or the rate threshold/rate limit.
01071acc : Cannot enable maintenance mode when device is forced offline.
Location:
/var/log/ltm, GUI, console
Conditions:
When the device is in forced offline mode; setting it to maintenance mode will not be allowed until the device is back online.
Impact:
None. Validation for a bad config operation.
Recommended Action:
None.
01071acd : The requested device (%s) was not found in self failover device group (%s).
Location:
/var/log/ltm, GUI, console
Conditions:
When a device is not a member of the failover group and a command is executed to specify a traffic group HA order, including the non-member device.
Impact:
The respective HA order command will be rejected with the validation error displayed in the respective UI.
Recommended Action:
Do not include devices that are not member of the failover group when specifying a traffic group HA order; or include the device non-member in the failover group before executing the HA order command.
01071ad3 : The requested provision module (%s) is not compatible with already provisioned module (%s).
Location:
GUI, console
Conditions:
(1) User tries to provision URLDB module, but SWG module is already configured.
(2) User tries to provision SWG module, but URLDB module is already configured.
Impact:
None.
Recommended Action:
Either provision SWG or URLDB module, depending on the use case, but not both.
01071ad4 : LSN pool %s shares the same name as security nat source translation object. LSN iRules that take in 'pool name' as an argument would default to LSN objects
Location:
GUI, CLI
Conditions:
Name of the object has to be unique across LSN Pools and Source translation object, and if the user is attempting to configure a LSN Pool or Source translation Object with name that is already in use by another LSN Pool or Source translation object, this mcpd validation error is thrown to the user via GUI or TMSH.
Impact:
Creation of the LSN pool or FW NAT source translation object would fail unless user uses a different name.
Recommended Action:
None
01071ad9 : Security NAT Source Translation object %s shares the same name as LSN pool. LSN iRules that take in 'pool name' as an argument would default to LSN objects.
Location:
GUI, CLI
Conditions:
This is a warning message shown to the user if the user is attempting to configure the FW Nat source translation object with a name that is already in use by another LSN Pool.
Impact:
User would see this warning, but the configuration will go through fine. So No impact.
Recommended Action:
None
01071af3 : URL parameters cannot be entangled for Mobile while no parameter is encrypted for Mobile in the Anti-Fraud profile '%s'.
Location:
mcpd, tmsh console, and GUI
Conditions:
Trying to enable Mobilesafe parameter's both encrypt and enforce (entangle) options.
Impact:
Mobilesafe Parameter can have encrypt or enforce options enabled, but not both.
Recommended Action:
None.
01071af8 : The firewall rule UUID cannot be modified by user once it's created.
Location:
/var/log/ltm
Conditions:
A user has tried to modify the policy rule UUID value.
Impact:
The operation to modify the policy rule fails.
Recommended Action:
Modify the policy rule without changing the UUID value.
01071af8 : The firewall rule UUID (%s) already exists in other rules.
Location:
/var/log/ltm
Conditions:
A firewall rule is attempting to use the same UUID that exists in another firewall policy.
Impact:
You cannot create the policy.
Recommended Action:
Try to create the policy with a different rule UUID.
01071af9 : The specified firewall rule UUID (%s) is diffrent from exists rule UUID.
Location:
/var/log/ltm
Conditions:
A different rule UUID has been applied to the same rule.
Impact:
Modifying the rule or re-creating the rule operation fails.
Recommended Action:
Allow the system to choose the rule UUID instead of specifying a different UUID for the same rule.
01071aff : AOM webui is not available in this release.
Location:
/var/log/ltm
Conditions:
When the user tries the following tmsh commands:
- modify sys aom webui enabled
- modify sys aom webui disabled
Impact:
The AOM web services are not supported in this release of BIG-IP software. Typing the tmsh command doesn't do anything.
Recommended Action:
None.
01071b00 : AOM vkvm is not available in this release.
Location:
/var/log/ltm
Conditions:
When the user tries the use one of the following the tmsh commands:
- modify sys vkvm enabled
- modify sys vkvm disabled
Impact:
This tmsh command does not do anything. The AOM Virtual Keyboard, Video and Mouse redirection is not supported in this release of BIG-IP software.
Recommended Action:
None.
01071b1d : The %s (%s) cannot be created because the %s secret generation failed due to (%s).
Location:
/var/log/ltm, GUI, tmsh console
Conditions:
This error can occur when you add Access:Federation:OAuthAuthorizationServer:ClientApplication or Access:Federation:OAuthAuthorizationServer:ResourceServer.
The error occurs when secret generation fails for the above instance.
Secret generation can fail due to:
-- Random generator failure.
-- MAC address read failure.
-- Memory allocated for the secret is not sufficient.
Impact:
The instance cannot be created for Access:Federation:OAuthAuthorizationServer:ClientApplication or Access:Federation:OAuthAuthorizationServer:ResourceServer.
Recommended Action:
None
01071b27 : Scope name cannot be empty for OAuth Authorization agent %s.
Location:
/var/log/apm, TMSH
Conditions:
The scope name is empty in the OAuth Authorization agent.
Impact:
Object save will fail.
Recommended Action:
Specify a scope name in the OAuth Authorization agent.
01071b28 : Scope name (%s) associated with OAuth Authorization agent (%s) is not defined under OAuth scope.
Location:
/var/log/apm, TMSH
Conditions:
If the scope referenced in the OAuth Authorization agent is not created under OAuth Scope, this error will be seen
Impact:
Object save will fail.
Recommended Action:
Create the scope under OAuth Scope first, and then it can be referenced in the OAuth Authorization agent.
01071b29 : %s entry refers to invalid OAuth Authorization agent %s, entry %d.
Location:
/var/log/apm, TMSH
Conditions:
This occurs when the OAuth Authorization Agent Scope or Claim entry refers to an invalid OAuth Authorization agent and its entry.
Impact:
Object won't be saved.
Recommended Action:
Specify the correct OAuth Authorization agent and its entry while creating or modifying an OAuth Authorization agent Scope or Claim entry.
01071b2c : The client app (%s) that is associated with the %s (%s) does not exist.
Location:
/var/log/apm, TMSH
Conditions:
This appears when a client app is referenced in an OAuth profile, and that OAuth client app does not exist.
It also appears when a JWT access token claim is associated with a client app, and the reference client app does not exist.
Impact:
Object save will fail.
Recommended Action:
Make sure that the client app is valid, or create one if necessary. And then, the client app can be referenced in the OAuth Profile, or while associating a JWT access token claim with the client app.
01071b3b : Notice: Purging initiated for OAuth DB Instance (%s). Time taken for DB purging depends on the amount of data; BIG-IP performance may be affected during this time. Only expired tokens will be removed.
Location:
/var/log/ltm, GUI, CLI
Conditions:
An administrator initiates an immediate DB purge of expired tokens (via the Purge Now button).
Impact:
BIG-IP system performance might be affected during this time.
Recommended Action:
None.
01071bad : The certificate (%s) can not simultaneously use a cert-validator (%s) and be configured as the %s of a cert-validator (%s).
Location:
/var/log/ltm, console, iControl, GUI
Conditions:
A conflicting configuration occurred, based on the configuration order:
Order 1: The certificate already has a cert-validator configured, but the user is trying to configure this certificate as some cert-validator's trusted responder or signer certificate.
Order 2 (the other way around): The certificate is already a trusted responder or signer certificate of some cert-validator, but the user is trying to assign a cert-validator to it.
Impact:
None.
Recommended Action:
None.
01071bbd : SSL profile (%s): When CRL configuration name (%s) is specified, both static CRL file (%s) and Allow-Expired-CRL settings are not allowed.
Location:
/var/log/ltm
Conditions:
A user has attempted to configure a CRL object and a static CRL file together in a Client SSL profile.
Impact:
The system has successfully prevented the user from an invalid configuration. There is no impact to the user.
Recommended Action:
None.
01071bcd : Security NAT Source Translation object (%s) cannot use both Self IP and DSLITE tunnel for PCP configuration.
Location:
GUI, CLI
Conditions:
If user is attempting to configure both the DSLITE and Self IP parameters in the PCP configuration in FW NAT source translation object, this error messages is shown to the user.
Impact:
Creation/Modification of the FW NAT source translation object would fail unless removes either of the Self IP or DS Lite tunnel PCP configuration.
Recommended Action:
None
01071bd1 : Inbound CMI connection from IP (%s) denied because it came from VLAN (%s), not from expected VLAN (%s).
Location:
/var/log/ltm
Conditions:
This should not happen under any circumstances.
Impact:
Mcpd has detected that sync traffic is being sent over a VLAN that is not the correct one. Therefore, if any traffic is sent, it is unexpectedly unencrypted. For security purposes, sync is disabled.
Recommended Action:
There is no workaround.
01071bd6 : %s (%s): Cannot enable Device-ID without enabling Bot Signatures and the 'Search Engine' Bot Signature Category.
Location:
/var/log/ltm, console
Conditions:
Using tmsh to create or modify a dos profile with application enabled, and enabling the device-id field without enabling the Search Engine Bot Signature Category.
Impact:
Creation or modification of the dos profile will fail.
Recommended Action:
Create the dos profile using two separate steps. For example:
create security dos profile dos1 application add { dos { bot-signatures { check enabled } } }
modify security dos profile dos1 application modify { dos { tps-based { device-captcha-challenge enabled } } }
01071bd8 : The tag-mode for requested member %s has to be 'none' on platforms that do not support QinQ.
Location:
/var/log/ltm
Conditions:
If the user attempts to configure the tag-mode of a VLAN member to some other value, but 'none' on platforms that do not support QinQ, the MCP validation rejects the configuration, and an error message is logged in the /var/log/ltm.
Impact:
The configuration issued via tmsh command is rejected as invalid.
Recommended Action:
If the user has to configure QinQ functionality, the use must switch to using a platform that supports QinQ.
01071be4 : port-fwd-mode value of interface (%s) is not compatible with vlan (%s) member interface (%s).
Location:
/var/log/ltm
Conditions:
This message is caused by an invalid configuration. When adding a member to a VLAN, the member's forwarding mode must be the same as other members in the vlan. For example, the port-fwd-mode value of the interface must be the same value as other interfaces in the same VLAN.
Impact:
Unable to add the member.
Recommended Action:
Inspect the relevant object configuration in VLAN, trunk, and interface. Do not add an incompatible member with different port-fwd-mode value to the same VLAN.
01071be5 : Member interface (%s) of trunk (%s) not found.
Location:
/var/log/ltm
Conditions:
Caused by an invalid configuration when a trunk consists of a interface, but the interface does not exist. This is very unlikely to happen.
Impact:
The interface will not be added.
Recommended Action:
Inspect the relevant object configuration in the trunk and interface. Delete the trunk object and re-create it.
01071be6 : port-fwd-mode value of interface (%s) is not compatible with trunk (%s) member interface (%s).
Location:
/var/log/ltm
Conditions:
This is caused by an invalid configuration. All interfaces in the same trunk must have the port-fwd-mode property set to the same value.
Impact:
None.
Recommended Action:
Inspect the relevant object configuration in trunk and interface. Only add interfaces with the same port-fwd-mode value to the same trunk.
01071bed : The URL (%s) belongs to Custom Category (%s) has invalid type as regex-match and not supported yet.
Location:
/var/log/ltm
Conditions:
When the custom category url type is mentioned as regex type, you would see this message in /var/log/ltm. This regex type is not exposed in TMUI or GUI. This is only possible through programmatic internal access.
Impact:
You will not see this message in console or GUI, because regex type is not exposed.
Recommended Action:
None.
01071bee : SSLv2 is no longer supported and has been removed. The 'sslv2' keyword in the cipher string has been ignored.
Location:
/var/log/ltm
Conditions:
This message appears if an ssl profile is parsed that has the sslv2 enabled. This is a warning that appears in the logs.
Impact:
The high level impact is that you are using an ssl profile that previously tried to enable sslv2. We have disabled sslv2 and this is warning them that we are ignoring the fact that they tried to enable sslv2. SSLv2 has numerous vulnerabilities and enabling it can even open up vulnerabilities in more secure versions of SSL or TLS.
Recommended Action:
Remove the "sslv2" string from the cipher list.
01071bf0 : Vlan %s c-tag %s is out of range.
Location:
/var/log/ltm
Conditions:
MCP validation code rejects the tmsh configuration for a vlan tag that is grater than 4094 or less than 1. An error is logged in /var/log/ltm.
Impact:
The configuration issued via tmsh command is rejected as invalid.
Recommended Action:
Reissue the tmsh command with a VLAN tag, which is less than or equal to 4094, and equal to or greater than 1.
01071bf1 : Vlan %s tag %d is out of range.
Location:
/var/log/ltm
Conditions:
When the user attempts via tmsh to configure a VLAN tag which is greater than 4094, the MCP validation code rejects the configuration and an error message is logged at /var/log/ltm.
Impact:
The configuration issued via a tmsh command is rejected as invalid.
Recommended Action:
Reissue the tmsh command with a VLAN tag, which is less than or equal to 4096.
01071bf6 : Cannot change FIPS name on busy guest: %s.
Location:
/var/log/ltm
Conditions:
The user tries to change the "fips-name" property of a vCMP guest configuration while the guest is running.
Impact:
The system does not allow the change operation because the guest might be actively using the FIPS partition referred to by the "fips-name" property. As a result, the configuration remains unmodified.
Recommended Action:
Before changing the "fips-name" property of the guest, disable the guest and wait until it stops running.
01071bf7 : Invalid URL format %s in CA-bundle manager %s. Check help page.
Location:
/var/log/ltm
Conditions:
The proxy server configuration on the CA-bundle manager object is restricted to use HTTP proxy.
Impact:
None.
Recommended Action:
The proxy server should be prefixed with HTTP or none.
01071bf8 : Bundle manager %s cannot use a certificate file object %s that depends on itself. This would cause a cyclic dependency.
Location:
/var/log/ltm
Conditions:
CA-bundle manager can be configured with other CA-bundles as sources. In this case, the newly created CA-bundle manager is trying to manage a CA-bundle file that eventually depends on itself. For example, CA-bundle manager A depends on a CA-bundle B managed by CA-bundle manager B, and B is in turn dependent on CA-bundle A.
Impact:
None.
Recommended Action:
Check the dependency relationship between the newly created CA-bundle manager and its included or excluded CA-bundle sources.
01071bf9 : CA-bundle management trace: CA-bundle %s depends on %s.
Location:
/var/log/ltm
Conditions:
CA-bundle manager can be configured with other CA-bundles as sources. In this case, the newly created CA-bundle manager is trying to manage a CA-bundle file, which eventually depends on itself. For example, CA-bundle manager A depends on a CA-bundle B, managed by CA-bundle manager B, and B is in turn dependent on CA-bundle A.
Impact:
None.
Recommended Action:
Check the dependency relationship between the newly created CA-bundle manager and its included or excluded CA-bundle sources.
01071bfa : CA-bundle manager %s does not exist.
Location:
/var/log/ltm
Conditions:
A database join operation refers to a CA-bundle manager that does not exist.
Impact:
None.
Recommended Action:
None.
01071bfb : The default CA-bundle manager %s cannot be deleted.
Location:
/var/log/ltm
Conditions:
The default CA-bundle manager called ca-bundle is being deleted.
Impact:
None.
Recommended Action:
The default CA-bundle manager called ca-bundle cannot be deleted.
01071bfc : The default CA-bundle manager %s cannot be changed.
Location:
/var/log/ltm
Conditions:
An attempt is being made to modify the default CA-bundle manager named ca-bundle.
Impact:
The default CA-bundle manager nameed ca-bundle cannot be modified.
Recommended Action:
None.
01071bfd : The default CA-bundle manager %s cannot change the exclude-url or exclude-bundle sets.
Location:
/var/log/ltm
Conditions:
The default CA-bundle manager called ca-bundle is being modified, regarding the exclude CA-bundles.
Impact:
None.
Recommended Action:
The default CA-bundle manager called ca-bundle cannot be modified.
01071bfe : The port number must be removed from %s, and set separately.
Location:
/var/log/ltm
Conditions:
The URL downloads in the CA-bundle manager configuration might use a proxy. The proxy server and port number are set separately.
Impact:
None.
Recommended Action:
The proxy server and port number are set separately using different attributes.
01071bfe : %s: %s can't be deleted because %s.
Location:
/var/log/ltm, GUI, tmsh
Conditions:
When a configuration object is not allowed to be deleted in the certain situation (described in the message), the error message will be triggered.
If this happens, the related configuration will not be updated.
Impact:
The related configuration will not be updated.
Recommended Action:
The fix that the reason described in the message as to why it cannot be deleted.
01071bff : The trusted CA-bundle must be provided in CA-bundle manager %s in order to download from URLs.
Location:
/var/log/ltm
Conditions:
The CA-bundle manager has an include or exclude URL source, but the trusted CA-bundle is not provided for downloading from the URL source.
Impact:
None.
Recommended Action:
When a CA-bundle manager refers to URL resource as a source, it must also provide the trusted CA-bundle.
01071c00 : The requested certificate file object %s for %s was not found.
Location:
/var/log/ltm
Conditions:
The certificate file object referred by the CA-bundle manager is not yet set up in the configuration database.
Impact:
Fail to set up the CA-bundle manager.
Recommended Action:
Create the proper certificate file object before referring to the object in the CA-bundle manager.
01071c01 : Object %s cannot be used in both include and exclude sets in CA-bundle manager %s.
Location:
/var/log/ltm
Conditions:
The same CA-bundle source, either from local file system or remote URL, is used as both include-source and exclude-source when users configure a CA-bundle manager.
Impact:
None.
Recommended Action:
Users must not use the same CA-bundle source as both include and exclude sources.
01071c02 : CA-bundle URL %s in CA-bundle manager %s only supports HTTPS.
Location:
/var/log/ltm
Conditions:
Users may try to use a CA-bundle manager to compose a new CA-bundle by downloading remote CA-bundle through HTTP or other protocols, such as SFTP.
Impact:
CA-bundle download methods other than HTTPS are disallowed.
Recommended Action:
Use a HTTPS URL.
01071c03 : F5 CA-bundle %s cannot be dynamically managed.
Location:
/var/log/ltm
Conditions:
User may try to create a CA-bundle manager that will manage the update operations of the CA-bundle f5-ca-bundle.crt.
Impact:
The special CA-bundle f5-ca-bundle.crt cannot be managed by the CA-bundle manager due to security reasons. It has to be updated manually, or by F5 official releases.
Recommended Action:
It is a required feature, not to be fixed.
01071c04 : Cannot find device group (%s).
Location:
/var/log/ltm
Conditions:
No device group is configured: needed for policy sync feature.
Impact:
Policy sync validation fails.
Recommended Action:
Create a device group and use it for policy sync.
01071c05 : Cannot find Policy Sync object definition file (%s).
Location:
/var/log/ltm
Conditions:
Cannot find data file(s) needed for the policy sync feature.
Impact:
Policy sync validation fails.
Recommended Action:
Configure data files to use for policy sync.
01071c06 : Cannot find Policy Sync object list file (%s).
Location:
/var/log/ltm
Conditions:
Cannot find the Policy Sync object list file.
Impact:
Policy sync validation fails.
Recommended Action:
Configure the Policy Sync object list file.
01071c07 : Cannot find Policy Sync data file (%s).
Location:
/var/log/ltm
Conditions:
Cannot find the Policy Sync data file.
Impact:
Policy sync validation fails.
Recommended Action:
Configure the Policy sync data file.
01071c08 : Cannot determine whether agent type %s is appropriate for access policy (%s) of type %s because it is not attached to apm profile access using access-policy property.
Location:
/var/log/ltm
Conditions:
Cannot determine whether agent type is appropriate for access policy because it is not attached to apm profile access using access-policy property.
Impact:
Access policy validation failure.
Recommended Action:
Attach access policy to access profile.
01071c09 : Cannot determine whether agent type %s is appropriate for access policy (%s) of type %s because visibility is not properly defined.
Location:
/var/log/ltm, GUI, CLI GUI
Conditions:
It cannot be determined whether agent type is appropriate for access policy because visibility is not properly defined.
Impact:
Access policy validation fails.
Recommended Action:
Fix policy agent visibility.
01071c0a : Cannot determine whether agent type %s is appropriate for access policy (%s) of type %s parent of access policy (%s) of type %s because it is not attached to apm profile access using access-policy property.
Location:
/var/log/ltm, GUI, CLI
Conditions:
It cannot be determined whether the agent type is appropriate for the access policy type of parent access policy. This is because the policy is not attached to the access profile using the access-policy property.
Impact:
Access policy validation failure.
Recommended Action:
Attach an access policy to the access profile.
01071c0b : Cannot determine whether agent type %s is appropriate for access policy (%s) of type %s parent of access policy (%s) of type %s because visibility is not properly defined.
Location:
/var/log/ltm, GUI, CLI
Conditions:
It cannot be determined whether the agent type is appropriate for the access policy of the parent of the access policy because visibility is not properly defined.
Impact:
Access policy validation failure.
Recommended Action:
Fix agent visibility.
01071c0c : Categories can't be assigned without selecting dynamic bwc policy.
Location:
/var/log/tmsh, GUI, CLI
Conditions:
There is no bandwidth control (BWC) policy during agent resource assignment.
Impact:
Agent resource assignment cannot be completed.
Recommended Action:
Define a BWC policy.
01071c0d : Default attribute consuming service (%s) must be present in the list 'attribute-consuming-services' of apm saml aaa (%s)
Location:
/var/log/ltm, tmsh, GUI
Conditions:
Misconfiguration.
An admin attempts to configure a default attribute consuming service in apm aaa saml object.
Selected 'default' attribute consuming service must be present in the list 'attribute-consuming-services' associated with apm aaa saml object. Error indicated that selected default value is not present in the list.
Impact:
This is mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
A 'default' attribute consuming service must be first configured in 'attribute-consuming-services' associated with apm aaa saml object. After that, the service can be selected as 'default'.
01071c0e : Attribute consuming service session variable and object cannot be configured at the same time in agent (%s)
Location:
/var/log/ltm, tmsh
Conditions:
Administrator attempts to change configuration on 'apm policy agent aaa-saml' object,
and set both properties 'attribute-consuming-service' and 'attr-consuming-service-session-var'.
This is not valid configuration.
Impact:
This is mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
Configure either 'attribute-consuming-service' or 'attr-consuming-service-session-var' property of 'apm policy agent aaa-saml' object.
01071c0f : Attribute consuming service variable (%s) in agent (%s) is not in session variable format
Location:
/var/log/ltm, tmsh
Conditions:
Administrator attempts to change configuration on 'apm policy agent aaa-saml' object,
and set property 'attr-consuming-service-session-var'. The provided value is not in valid format "%{session.var}".
Impact:
This is an mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
The 'attr-consuming-service-session-var' must refer to a valid session variable, for example, "%{session.var}".
01071c10 : 'attribute-name' must be configured for attribute (%s) in attribute-consuming-service (%s)
Location:
/var/log/ltm, tmsh, GUI
Conditions:
An administrator attempts to configure 'apm saml attribute-consuming-service' object.
The object permits specifying list of attributes. Each attribute must have a unique 'attribute-name' property.
Impact:
This is an mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
Provide 'attribute-name' value for specified attribute.
01071c11 : All attribute names must be unique within attribute-consuming-service (%s). Provided attribute name (%s) is not unique
Location:
/var/log/ltm, tmsh, GUI
Conditions:
An administrator attempts to configure 'apm saml attribute-consuming-service' object.
The object permits specifying list of attributes. Each attribute must have a unique 'attribute-name' property.
Impact:
This is an mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
Provide a *unique* 'attribute-name' value for specified attribute.
01071c12 : attribute-consuming-service (%s) must specify at least one attribute
Location:
/var/log/ltm, tmsh, GUI
Conditions:
An administrator attempts to configure 'apm saml attribute-consuming-service' object.
The object permits specifying list of attributes. At least one attribute must be configured for every object.
Impact:
This is mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
Configure an attribute for specified attribute-consuming-service object.
01071c13 : attribute-consuming-service-index (%d) in aaa saml server (%s) conflicts with index of existing service (%s). Please provide unique index.
Location:
/var/log/ltm, tmsh
Conditions:
An administrator attempts to configure apm aaa saml object to modify a list of attribute consuming services. The explicitly provided index for attribute consuming service is not unique for said aaa saml object.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
Do not specify index when configuring a list of attribute consuming services in aaa saml object.
Index will be auto generated when not explicitly specified.
If index must be specified manually, provide a unique value for the index. Value must be unique per aaa saml object.
01071c14 : 'service-name' value must be configured in attribute-consuming-service (%s)
Location:
/var/log/ltm, tmsh, GUI
Conditions:
An administrator attempts to configure 'apm saml attribute-consuming-service' object.
The object requires non-empty value for property 'service-name', which was not provided resulting in error.
Impact:
This is an mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
Provide a value for 'service-name' property of attribute-consuming-service object.
01071c15 : aaa saml server must be configured before attribute consuming service can be specified
Location:
/var/log/ltm, tmsh, VPE UI
Conditions:
An administrator attempts to change configuration on 'apm policy agent aaa-saml' object,
and set property 'attribute-consuming-service', but aaa saml service has not been specified for this agent.
Impact:
This is an mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
Specify aaa saml server property for 'apm policy agent aaa-saml', and then provide value for 'attribute-consuming-service'.
01071c16 : SAML agent (%s) specifies attribute consuming service (%s) that is not configured in aaa saml server (%s)
Location:
/var/log/ltm, tmsh, VPE UI
Conditions:
An administrator attempts to change configuration on 'apm policy agent aaa-saml' object,
and set property 'attribute-consuming-service'.
However, the chosen 'attribute-consuming-service' object is not present in the list of services associated with specified aaa saml server.
Impact:
This is an mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
Add requested service in the list 'attribute-consuming-services' of aaa saml server.
01071c18 : Attribute consuming service (%s) cannot be removed from aaa saml server (%s) because service is set as default
Location:
/var/log/ltm, tmsh, GUI
Conditions:
Misconfiguration.
An admin attempts to delete a service from the list of 'attribute-consuming-services' associated with apm aaa saml object that is also configured as 'default' attribute consuming service for that apm aaa saml object. Error indicated that this configuration is not valid.
Impact:
This is an mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
The service must be removed as 'default' attribute consuming service for the apm aaa saml object first and then deleted from the list of 'attribute consuming services' associated with the apm aaa saml object.
01071c19 : The requested username source (%s) is not a valid session variable.
Location:
/var/log/ltm, tmsh, VPE UI
Conditions:
Admin can define multiple session variables for username source. If one of these session variables is not valid, this error occurs.
Impact:
Admin can't configure username source field. It is considered to be an mcp configuration error.
Recommended Action:
None.
01071c1a : The requested password source (%s) is not a valid session variable.
Location:
/var/log/ltm, tmsh, VPE UI
Conditions:
Admin can define multiple session variables for password source. If one of these session variables is not valid, this error will be thrown.
Impact:
Admin can't configure password source field. It is considered to be an mcp configuration error.
Recommended Action:
None.
01071c1b : Virtuals Servers in the same listener group can have different profiles. Modifying the profiles in the listener will not update the profiles in the Virtual Servers. To update the profiles in Virtual servers, modify the Virtual Servers individually.
Location:
Console, TMSH
Conditions:
Attempt to modify spm or subscriber management profile for a PEM listener.
Impact:
Modification of spm and subscriber management profile for the PEM listener is blocked.
Recommended Action:
User has to directly modify the virtual servers in the listener group, as suggested in the error message.
01071c1c : You cannot delete the nodejs version (%s).
Location:
/var/log/ltm
Conditions:
There is an attempt to delete the known nodejs versions maintained by MCPD. This action is not exposed via tmsh or the GUI; it is the result of a 'backdoor' attempt.
Impact:
None. The attempt tp change the node version is blocked.
Recommended Action:
None.
01071c1d : You cannot modify the nodejs version (%s).
Location:
/var/log/ltm
Conditions:
An attempt is made to modify the known nodejs versions maintained by MCPD. Since this action is not exposed via tmsh or the GUI, it is the result of a 'backdoor' attempt.
Impact:
None.
Recommended Action:
None.
01071c1e : Cannot perform Protocol inspection update: %s
Location:
/var/log/ltm
Conditions:
The Protocol Inspection module failed (load/install/delete) with the Update package.
Impact:
The Protocol Inspection update package action is not performed.
Recommended Action:
None.
01071c1f : Protocol Inspection compliance inspection %s requires valid value: %s
Location:
/var/log/ltm
Conditions:
attempt to set invalid compliance inspection value
The user runs the following tmsh command with an invalid compliance inspection value:
"modify security protocol-inspection profile <profile name> { services modify { <service name> { compliance modify { <compliance inspection name> { value <value> } }}}}"
Impact:
None.
Recommended Action:
Do not set an invalid compliance inspection value (for example, if the type of the compliance inspection value is integer and you to set some string value).
01071c20 : Too many Protocol Inspection profiles. Up to %d supported.
Location:
/var/log/ltm
Conditions:
The limit of the number of allowed Protocol Inspection profiles has been reached.
Impact:
No more Protocol Inspection profiles can be added.
Recommended Action:
Delete unused / obsolete / not needed Protocol Inspection Profiles.
01071c22 : Modifying predefined Protocol Inspection profiles are not allowed.
Location:
/var/log/ltm
Conditions:
An attempt has been made to modify an "protocol_inspection" predefined profile. An example is the use of any tmsh command which starts with "modify protocol-inspection profile <predefined profile name> ... ".
Impact:
None.
Recommended Action:
Do not modify following "protocol_inspection" predefined profiles: "protocol_inspection", "protocol_inspection_dns",and "protocol_inspection_http"
01071c23 : Creating predefined Protocol Inspection profiles are not allowed.
Location:
/var/log/ltm
Conditions:
An attempt has been made to create a "protocol_inspection" predefined profile from tmsh.
Impact:
Creating a "protocol_inspection" profile with the name of a predefined profile from tmsh is disallowed. Predefined profiles have names such as "protocol_inspection", "protocol_inspection_dns", and "protocol_inspection_http".
Recommended Action:
Do not create a profile that has the same name as a predefined profile.
01071c24 : Deleting predefined Protocol Inspection inspections are not allowed.
Location:
/var/log/ltm
Conditions:
An attempt has been made to delete a "protocol_inspection" predefined inspection.
Impact:
None.
Recommended Action:
Do not delete "protocol_inspection" predefined inspections.
01071c25 : Modifying predefined Protocol Inspection inspections are not allowed.
Location:
/var/log/ltm
Conditions:
An attempt has been made to modify "protocol_inspection" predefined inspections.
Impact:
None.
Recommended Action:
Do not modify predefined inspections. A user can modify user-defined signatures only.
01071c27 : Protocol Inspection internal error: %s.
Location:
/var/log/ltm
Conditions:
This is an internal error.
Impact:
The "protocol_inspection" module does not work properly.
Recommended Action:
None.
01071c28 : Invalid Protocol Inspection snort signature: %s.
Location:
/var/log/ltm
Conditions:
The user has run one of the following tmsh commands with an incorrect snort signature:
"create security protocol-inspection signature <sig name> { sig "<snort signature>" ... }"
"modify security protocol-inspection signature <sig name> { sig "<snort signature>" ... }"
Impact:
None.
Recommended Action:
Create correct signatures in valid snort format.
01071c2a : Creating/Modifying Protocol Inspection compliance enums are not allowed.
Location:
/var/log/ltm
Conditions:
An attempt has been made to create or modify "protocol_inspection" compliance enums.
Impact:
Creating or modifying "protocol_inspection" compliance enums is disallowed.
Recommended Action:
Do not create or modify "protocol_inspection" compliance enums.
01071c2b : Deleting Protocol Inspection services are not allowed.
Location:
/var/log/ltm
Conditions:
An attempt has been made to delete a "protocol_inspection" service.
Impact:
Deleting a "protocol_inspection" service is disallowed.
Recommended Action:
Do not delete a "protocol_inspection" service.
01071c2c : Creating/Modifying Protocol Inspection services are not allowed.
Location:
/var/log/ltm
Conditions:
An attempt has been made to create or modify a "protocol_inspection" service.
Impact:
Creating or modifying a "protocol_inspection" service is disallowed.
Recommended Action:
Do not create or modify a "protocol_inspection" service.
01071c2d : The VLAN (%s) tag is %u. The port-fwd-mode value of %s (%s) must be set to (%s).
Location:
/var/log/ltm
Conditions:
This is caused by an invalid configuration; a VLAN with the tag 'any.' The VLAN member must have the port-fwd-mode set to 'l2wire.'
Impact:
None.
Recommended Action:
Inspect the relevant object configuration in VLAN, trunk, and interface. You can add an interface with port-fwd-mode set to 'l2wire' to a VLAN with a tag 'any.' You can also add a trunk with interface members with a port-fwd-mode set to 'l2wire' to a VLAN with the tag 'any.'
01071c2e : The VLAN (%s) can have at most %u member because member (%s) port-fwd-mode value is (%s).
Location:
/var/log/ltm
Conditions:
A VLAN to which you assign an interface or trunk with the port-fwd-mode property set to 'l2wire' can have a maximum of one member.
Impact:
None.
Recommended Action:
Inspect the relevant object configuration for the VLAN, trunk, and interface. Don't add more than one member to the VLAN if a VLAN member (interface) has the port-fwd-mode property set to 'l2wire'.
01071c2f : The requested VLANGROUP (%s) can have at most %u member(s) because VLAN members have virtual-wire members.
Location:
/var/log/ltm
Conditions:
The configuration is invalid. A VLAN group containing VLANs with visual-wire members can have at most 2 VLANs.
Impact:
None.
Recommended Action:
Inspect the relevant object configuration in the VLAN group, VLAN, trunk, and interface. Don't add more than 2 VLANs to a VLAN group if a VLAN has virtual wire members.
01071c30 : Vlan (%s) is not compatible with member vlan in VLANGROUP (%s).
Location:
/var/log/ltm
Conditions:
The configuration is invalid. The VLANs in a VLAN group must contain interfaces for which the value of the forwarding mode property is the same.
Impact:
None.
Recommended Action:
Inspect the relevant object configuration in VLAN group, VLAN, trunk, and interface. Modify VLANs in the same VLAN group so that all interfaces have the same value for the forwarding mode property.
01071c31 : The VLANGROUP (%s) mode and the VLAN (%s) member (%s) port-fwd-mode are not compatible.
Location:
/var/log/ltm
Conditions:
The configuration is invalid. The mode of the VLAN group is not set to 'virtual wire', even though the VLAN member being added to the VLAN group consists of interfaces with the forwarding mode property set to 'virtual wire'.
Impact:
None.
Recommended Action:
Inspect the relevant object configuration in VLAN group, VLAN, trunk, and interface. Change the mode of the VLAN group to 'virtual wire' when adding a VLAN that contains an interface with the forwarding mode property set to 'virtual wire'.
01071c32 : The VLANs must have the same tag in VLANGROUP (%s) when they have l2wire member.
Location:
/var/log/ltm
Conditions:
The configuration is invalid. The VLAN group contains VLANs that include a trunk or an interface with the forwarding mode property set to 'virtual wire', but the tags for the VLANs do not match.
Impact:
None.
Recommended Action:
Modify or re-create the VLANs with the same tag before adding the VLANs to the same VLAN group.
01071c32 : The VLANs must have the same tag in VLANGROUP (%s) when they have virtual-wire member.
Location:
/var/log/ltm
Conditions:
The message is caused by an invalid configuration. When vlan-group consists of vlans, which consist of trunks or interfaces with port-fwd-mode set to 'virtual-wire', the vlans must have the same tag.
Impact:
None.
Recommended Action:
Modify or re-create the vlans with the same tag, before adding them to the same vlan-group.
01071c33 : The VLAN (%s) tag (%u) cannot be modified %s '4096'.
Location:
/var/log/ltm
Conditions:
You cannot change the VLAN tag of an existing VLAN from the special tag 4096 to a numeric tag, or from a numeric tag to the special tag 4096.
Impact:
None.
Recommended Action:
Delete the VLAN and re-create the VLAN with the new tag.
01071c34 : The requested member (%s) is already configured as a member of VLAN (%s) with tag (%d). A member can belong to only one VLAN for a given tag.
Location:
/var/log/ltm
Conditions:
The configuration is invalid. The system attempted to assign the same 'virtual wire' interface, either tagged or untagged, to more than one VLAN.
Impact:
None.
Recommended Action:
Inspect the relevant object configuration in VLAN group, VLAN, trunk, and interface. Do not attempt to add the same 'virtual wire' interface to more than one VLAN.
01071c34 : The requested member (%s) is already configured as a member of VLAN (%s) with tag (%u). A member can belong to only one VLAN for a given tag.
Location:
/var/log/ltm
Conditions:
This message is caused by an invalid configuration. A 'virtual-wire' interface can be a member of at most one VLAN. It cannot be a member of another VLAN, no matter it is tagged or untagged.
Impact:
None.
Recommended Action:
Inspect the relevant object configuration in vlan, trunk, and interface. Don't add a 'virtual-wire' interface to more than one VLAN.
01071c35 : The VLAN (%s) has %s interface while the VLAN (%s) has %s interface. Interfaces of VLANs that are in the same 'virtual-wire' VLANGROUP (%s) must have the same taggedness.
Location:
/var/log/ltm
Conditions:
The VLANs that are members of the VLAN group do not have the same VLAN tag.
Impact:
The VLAN configuration is invalid.
Recommended Action:
Inspect the relevant object configuration in the VLAN group, VLAN, trunk, and interface. Change the configuration to ensure matching tags for the VLANs in the VLAN group.
01071c36 : The SelfIP (%s) cannot associate with %s (%s) with (%s) interface.
Location:
/var/log/ltm
Conditions:
The system has an invalid configuration. The self IP address can only be associated with a VLAN or VLAN group that has either a Layer 3 interface or no interface. The self IP address cannot be associated with a VLAN or VLAN group that has an interface with its forwarding mode set to Passive or Virtual Wire.
Impact:
None.
Recommended Action:
Inspect the relevant object configuration in the VLAN group, VLAN, and self IP address. Do not associate self IP address with a VLAN or VLAN group with a Passive or Virtual Wire interface.
01071c37 : %s: %s is not supported on this platform (%s).
Location:
/var/log/ltm
Conditions:
The configuration is invalid based on platform attributes. There are values in the field of this object that are not supported on certain platforms.
Impact:
None.
Recommended Action:
Inspect the relevant object configuration that causes the error.
01071c38 : Rule Profiler object %s requires log publisher to be specified.
Location:
/var/log/ltm
Conditions:
The system is attempting to create an iRule profiler (tracer) without a log publisher and attempting to remove a log publisher from an iRule profiler (tracer).
Impact:
The iRule profiler (tracer) configuration cannot be created or modified.
Tracing iRules will not be possible.
Recommended Action:
Repeat the configuration operation, specifying a valid log publisher.
01071c38 : Modify of ephemeral %s (%s) is not permitted.
Location:
/var/log/ltm
Conditions:
User-initiated action (such as through 'tmsh') attempted to modify an ephemeral node, which is not allowed. Ephemeral nodes are created as a result of a DNS resolve operation, which creates an ephemeral node that maintains the configuration established through its parent FQDN template.
Impact:
No action occurred, and the configuration is unchanged. No further user action is necessary.
Recommended Action:
Instead of trying to modify a specific ephemeral node, the user may modify the FQDN template that is used to create ephemeral nodes, at which point the configuration changes will propagate to all existing and future ephemeral nodes that are created from that FQDN template.
01071c3a : Route MTU for (%s) below minimum %u.
Location:
/var/log/ltm
Conditions:
When creating a static route with an MTU below the minimum value of 68.
Impact:
An exception aborts the creation of static route.
Recommended Action:
Correct the MTU value to be above 68.
01071c3a : Invalid FQDN node %s: %s.
Location:
Tmsh, GUI
Conditions:
You attempt to create an FQDN node with a name that looks like an IP address, for example:
create ltm node 1.1.1.1 fqdn { name www.f5.com }
Impact:
The operation fails.
Recommended Action:
Choose a different name for the object.
01071c52 : Routing object (%s) cannot have both items: %s.
Location:
TMSH
Conditions:
This will occur if there is an attempt to have a routing object reference two objects that cannot be referenced at the same time.
Impact:
The user will not be able to have the object being configured reference both of the objects which are not allowed to be referenced at the same time. The user must choose either one or neither of the objects to reference.
Recommended Action:
Reference either one or neither of the objects attempting to be referenced.
01071c55 : Invalid as-path (%s): %s.
Location:
TMSH
Conditions:
This will occur if there is an attempt to create an invalid AS-Path object.
Impact:
The user will not be able to create the AS-Path object as configured.
Recommended Action:
Create the AS-Path object with valid values.
01071c56 : Invalid as-path entry (%s) for as-path (%s): %s.
Location:
TMSH
Conditions:
This will occur if there is an attempt to create an invalid AS-Path entry object.
Impact:
The user will not be able to create the AS-Path entry object as configured.
Recommended Action:
Create the AS-Path entry object with valid values.
01071c58 : Virtual server %s is in ALG mode. Must not use static source translation, as used by attached profile %s.
Location:
gui, cli (tmsh), /var/log/ltm
Conditions:
You have attempted to configure a virtual server in MRF mode with Application Level Gateway enabled on the router profile and a security nat policy with static source translation.
Impact:
Configuration will not load until it is corrected.
Recommended Action:
None.
01071c5c : Cannot disable AJAX encryption for URL '%s' while parameter '%s' has AJAX mapping enabled in the Anti-Fraud profile '%s'.
Location:
/var/log/ltm, GUI
Conditions:
Improper FPS URL configuration.
Impact:
Configuration will not load.
Recommended Action:
Disable parameter AJAX mapping before disabling AJAX encryption.
01071c5c : AJAX encryption or both AJAX integrity and strong integrity must be enabled for URL '%s' while parameter '%s' has AJAX mapping enabled in the Anti-Fraud profile '%s'.
Location:
/var/log/ltm, CLI
Conditions:
A URL has a parameter with a none empty AJAX mapping. A URL is valid only if it has either:
1) AJAX encryption is enabled (and RT encryption or parameter encrypt or a parameter substitute value is enabled), or
2) AJAX integrity is enabled and 3) Strong integrity is enabled
Therefore, disabling 1 and 2 or 3 is not allowed.
Impact:
The configuration fails.
Recommended Action:
1. Remove parameters with none-empty AJAX mapping on this URL.
2. DO NOT disable AJAX encryption AND AJAX integrity or Strong Integrity.
01071c5d : AJAX mapping '%s' for parameter '%s' cannot start or end with a '.' in the Anti-Fraud profile '%s' (Anti-Fraud URL: '%s').
Location:
tmsh, GUI
Conditions:
Trying to set invalid JSON path.
Impact:
Configuration will fail.
Recommended Action:
Set a valid JSON path.
01071c5e : Anti-Fraud parameter '%s' is invalid. Enabling AJAX mapping for parameter requires that either 1. AJAX encryption and either value substitution or Real-Time Encryption or parameter encryption enabled 2. Full and Enhanced AJAX Data Manipulation Check enabled in the Anti-Fraud profile '%s' (Anti-Fraud URL: '%s').
Location:
/var/log/ltm, GUI
Conditions:
Improper FPS profile configuration.
Impact:
Configuration will not load.
Recommended Action:
Either enable AJAX encryption or parameter value substitution.
01071c5f : Cannot %s when %s in the Anti-Fraud profile '%s' (Anti-Fraud URL: '%s').
Location:
/var/log/ltm, GUI
Conditions:
Improper FPS profile configuration.
Impact:
Configuration does not load.
Recommended Action:
Either enable a custom encryption function or enable Real-Time Encryption in the Anti-Fraud URL.
01071c60 : DynaD private key generation failed ('%s').
Location:
/var/log/ltm
Conditions:
Out-of-memory or internal OpenSSL failure.
Impact:
Encrypted DynaD instrumentation may fail to execute.
Recommended Action:
Consider restarting mcpd.
01071c61 : DynaD public key generation failed ('%s').
Location:
/var/log/ltm
Conditions:
Out-of-memory or OpenSSL error, invalid private key, and a bad public key (/var/lib/dynad/tmm.dynad.pub).
Impact:
Encrypted DynaD instrumentation may fail to execute
Recommended Action:
Multiple options (1) consider reloading the configuration, (2) deleting "sys dynad key" element from BIG-IP_base.conf, reload configuration, and (3) consider re-installing the software image.
01071c62 : DynaD failed to decrypt private key. Re-generating.
Location:
/var/log/ltm
Conditions:
This may occur if there is (1) a bad dynad key value (BIG-IP_base.conf:sys dynad key), or (2) a master-key mis-match.
Impact:
May be unable to execute encrypted DynaD instrumentation.
Recommended Action:
(1) Delete a key from BIG-IP_base.conf; reload configuration. (2) Restore the old master-key (https://support.f5.com/csp/article/K9420).
01071c63 : DynaD development mode requires an F5 development license.
Location:
/var/log/ltm
Conditions:
An attempt was made to enable dynad development-mode without a development license.
Impact:
dynad development-mode will remain disabled.
Recommended Action:
Obtain a development license.
01071c64 : DynaD signature verification failed ('%s').
Location:
/var/log/ltm
Conditions:
This message can occur due to:
a) Bad signature (invalid or does not match /var/lib/dynad/tmm.pub.key value)
b) Memory failure
c) System error (failure to read file)
Impact:
DynaD instrumentation signature could not be verified and will not be executed.
Recommended Action:
Contact support.
01071c65 : DynaD cannot activate unsigned instrumentation.
Location:
/var/log/ltm, console
Conditions:
DynaD instrumentation signature could not be verified (warning).
Impact:
DynaD instrumentation will not be activated. Full error details will be logged to /var/log/ltm.
Recommended Action:
Refer to recommended action for error found in /var/log/ltm. Consider contacting support.
01071c66 : The VLAN (%s) member (%s) must be tagged when the tag is '4096'.
Location:
/var/log/ltm
Conditions:
The configuration is invalid. When a VLAN has the special tag 4096, the VLAN member can only be configured as a tagged interface.
Impact:
None.
Recommended Action:
Inspect the relevant object configuration in the VLAN. Specify the VLAN interface as tagged when the VLAN tag is 4096.
01071c67 : The PEM rating group id needs to be greater than Zero. Rating group %s cannot use rating group id %d because it is invalid.
Location:
GUI, TMSH, /var/log/ltm
Conditions:
Occurs if the Rating group id field is set to Zero
Impact:
Configuration will be aborted, if rating group id field is set to zero while configuration.
Recommended Action:
Provide a valid rating group id (greater than 0).
01071c68 : Profile %s's SSL client certificate constrained delegation CA key is missing.
Location:
GUI, tmsh shell, iControl shell
Conditions:
When client certificate constrained delegation is enabled on one server-ssl profile, with client certificate constrained delegation CA key not configured.
Impact:
The client certificate constrained delegation cannot be enabled on this server-ssl until the user configures client certificate constrained delegation CA key.
Recommended Action:
None.
01071c69 : Profile %s's SSL client certificate constrained delegation CA cert is missing.
Location:
GUI, tmsh shell, iControl shell
Conditions:
When client certificate constrained delegation is enabled on one server-ssl profile, with client certificate constrained delegation CA certificate not configured.
Impact:
The client certificate constrained delegation cannot be enabled on this server-ssl until the user configures client certificate constrained delegation CA certificate.
Recommended Action:
None.
01071c6a : Profile %s's SSL client certificate constrained delegation peer-cert-mode is invalid.
Location:
GUI, tmsh shell, iControl shell
Conditions:
When client certificate constrained delegation is enabled on one client-ssl profile, and peer certificate mode not "request" or "require".
Impact:
The client certificate constrained delegation cannot be enabled on this client-ssl profile until the user configures peer certificate mode to "request" or "require".
Recommended Action:
None.
01071c6b : Profile %s supports only RSA key and certificate for SSL client certificate constrained delegation.
Location:
GUI, tmsh shell, iControl shell
Conditions:
When client certificate constrained delegation is enabled on one server-ssl profile, with client certificate constrained delegation CA key/certificate not RSA based.
Impact:
The client certificate constrained delegation cannot be enabled on this server-ssl until the user configures client certificate constrained delegation CA key/certificate with RSA type.
Recommended Action:
None.
01071c6c : Profile %s's SSL client certificate constrained delegation key is missing.
Location:
GUI, CLI, iControl
Conditions:
Client certificate constrained delegation is configured on one Server SSL profile and an RSA key and certificate are not configured.
Impact:
The client certificate constrained delegation cannot be enabled on this Server SSL profile.
Recommended Action:
Configure one RSA key and certificate.
01071c6d : Profile %s's SSL client certificate constrained delegation CA key and certificate do not match
Location:
/var/log/ltm
Conditions:
When configuring a server SSL profile for 'client certificate constrained delegation (C3D)', the configured CA key does not match the configured CA certificate.
Impact:
This is a new log message for C3D.
Recommended Action:
None.
01071c6e : PKCS11d (re)initialized. Re-connecting to network-HSM PKCS11d.
Location:
/var/log/ltm
Conditions:
The PKCS11d daemon is restarting.
Impact:
The message is benign and used to log the PKCS11d restart, so there is no impact.
Recommended Action:
None.
01071c72 : Policy '%s', rule '%s'; %s SSL server profile %s not found.
Location:
/var/log/ltm, tmsh, GUI
Conditions:
Condition occurs when a server SSL profile is specified but a matching profile is not found in the BIG-IP system. Check spelling. The command to find the list of known SSL server profiles is:
tmsh list ltm profile server-ssl
Impact:
The create/change operation fails.
Recommended Action:
Try again specifying a known SSL server profile. A list of the known SSL server profiles can be found using the following tmsh command:
tmsh list ltm profile server-ssl
01071c73 : F5 Service Connector %s validation error: %s.
Location:
/var/log/ltm
Conditions:
An F5 Service Connector validation error has occurred and is caused by any of these conditions:
- The name is already used.
- An SSL Server profile is missing or doesn't exist.
- A DNS resolver is missing or doesn't exist.
- An object cannot be deleted because it is referenced by an F5 MFA Configuration object.
Impact:
The system does not apply the configuration changes.
Recommended Action:
Depending on system conditions, you can take any of these actions:
- Use another name.
- Use an existing SSL Server profile.
- Use an existing DNS resolver.
- Delete a corresponding F5 MFA Configuration object first.
01071c74 : F5 MFA Configuration %s validation error: %s.
Location:
/var/log/ltm
Conditions:
An F5 MFA Configuration validation error has occurred and is caused by any of these conditions:
- The name is already used.
- Am F5 Service Connector is missing or doesn't exist.
- An allowed device type isn't specified.
- The SMS template doesn't contain the session variable %{session.f5_mfa.device_registration.registration_url}
- The object cannot be deleted because it is referenced by an F5 MFA User Verification agent or by F5 MFA Device Registration.
Impact:
The system does not apply the configuration changes.
Recommended Action:
Depending on system conditions, you can take any of these actions:
- Use another name.
- Use an existing F5 Service Connector name.
- Specify at least one allowed device type.
- Add the session variable %{session.f5_mfa.device_registration.registration_url} to the SMS template.
- Delete the corresponding agent or agents first.
01071c75 : F5 MFA User Verification Agent %s validation error: %s.
Location:
/var/log/ltm
Conditions:
An F5 MFA User Verification validation error has occurred and is caused by any of these conditions:
- The name is already used.
- A customization group is missing or has an incorrect type.
Impact:
The system does not apply the configuration changes.
Recommended Action:
Depending on system conditions, you can take any of these actions:
- Use another name.
- Use the name of an existing customization group of type aaa-f5-mfa-user-verification.
01071c76 : F5 MFA Device Registration Agent %s validation error: %s.
Location:
/var/log/ltm
Conditions:
An F5 MFA Device Registration Agent validation error has occurred and is caused by any of these conditions:
- The name is already used.
- A customization group is missing or has an incorrect type.
Impact:
The system does not apply the configuration changes.
Recommended Action:
Depending on system conditions, you can take any of these actions:
- Use another name.
- Use the name of an existing customization group of type aaa-f5-mfa-device-registration.
01071c77 : Issuer is required for JWT config (%s).
Location:
/var/log/apm, GUI, CLI
Conditions:
The issuer is not configured for JWT configObject.
Impact:
A save operation on an object or a configuration load operation fails.
Recommended Action:
Configure an issuer in JWT configObject.
01071c78 : Invalid %s (%s) in JWT config (%s). The value %s.
Location:
/var/log/apm, GUI, CLI
Conditions:
There is an invalid URI for issuer or JWKS URI attribute in JWT Config
Impact:
A save operation on an object or a configuration load operation fails.
Recommended Action:
Configure a valid URI.
01071c79 : Self-issued token is not allowed (%s) for JWT config (%s).
Location:
/var/log/apm, GUI, CLI
Conditions:
The issuer is configured to use a self-issued value ("https://self-issued.me") in a JWT configuration.
Impact:
A save operation on an object or a configuration load operation fails.
Recommended Action:
Use a valid issuer in the JWT Configuration.
01071c7a : In JWT config (%s), same signing algorithm is present in both allowed signing algorithms and blocked signing algorithms. This is not allowed.
Location:
/var/log/apm, GUI, CLI
Conditions:
The same signing algorithm is configured in both the allowed signing algorithms and the blocked signing algorithms in a JWT configuration.
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
Remove the same signing algorithm from the allowed signing algorithms or the blocked signing algorithms configuration in the JWT config.
01071c7b : OAuth Provider (%s) references OAuth JWT Config (%s) that does not exist.
Location:
This error will be logged in /var/log/apm. It will appear in TMSH/TMUI
Conditions:
JWT config in OAuth Provider is invalid/ does not exist.
Impact:
Object save/Configuration load will fail.
Recommended Action:
Use a valid JWT config in OAuth Provider.
01071c7c : When key-type is '%s', '%s' must be present for jwk-config (%s).
Location:
/var/log/apm, tmsh
Conditions:
Required fields are not present, or wrong key type specified.
Impact:
Configuration load will fail. Object save will fail.
Recommended Action:
Correct the invalid configuration.
01071c7d : The JWK config (%s) with key-type '%s' cannot contain an empty '%s'.
Location:
/var/log/apm,TMSH,GUI
Conditions:
Required fields are not present.
Impact:
Object save and Configuration Load will fail.
Recommended Action:
Fill in required fields.
01071c7e : The field (%s) is not relevant to key-type '%s' and thus cannot be present for jwk-config (%s).
Location:
/var/log/ltm, TMSH
Conditions:
Fields relevant to other key types are present.
Impact:
Configuration load and object save will fail.
Recommended Action:
Remove irrelevant fields.
01071c7f : Certificate key file must be referenced when passphrase is present for jwk-config (%s).
Location:
TMSH, GUI
Conditions:
While creating/modifying a JWK object, this error message will appear if a passphrase is specified but a certificate key is not.
Impact:
This JWK object creation/modification will not succeed.
Recommended Action:
Specify a certificate key reference.
01071c80 : JWT access token lifetime (%u) for %s (%s) must be in range of (%u-%u).
Location:
/var/log/ltm, GUI, TMSH console
Conditions:
The error occurs when the admin sets the JWT access token lifetime out of its valid range. Both the OAuth profile and the Client App configuration have a JWT access token lifetime setting.
Impact:
The out of range lifetime value will be rejected.
Recommended Action:
The admin should set the JWT access token lifetime within its valid range indicated by the error message.
01071c81 : JWT refresh token lifetime (%u) for %s (%s) must be in range of (%u-%u).
Location:
/var/log/ltm, GUI, TMSH console
Conditions:
The error happens when the admin sets the JWT refresh token lifetime out of its valid range. Both the OAuth profile and the Client App configuration have a JWT refresh token lifetime setting.
Impact:
The out of range value will be rejected.
Recommended Action:
The admin should set the JWT refresh token lifetime within its valid range indicated by the error message.
01071c82 : OpenID Connect Configuration Endpoint URL (%s) for %s (%s) must end with (%s).
Location:
/var/log/ltm, GUI, TMSH console
Conditions:
Per RFC specification, some URLs used in OpenID Connect must end with certain pattern, such as, the well-known endpoint must end with "/.well-known/openid-configuration". This error occurs if this kind of requirement is not met.
Impact:
The URL entered by the admin will not be accepted.
Recommended Action:
The admin should correct the URL per requirement.
01071c83 : (%s) (%s) load failed due to %s
Location:
/var/log/ltm, CLI
Conditions:
1) Mismatch between x5tsha1 in certificate and the value specified in object.
2) Mismatch between x5tsha256 in certificate and the value specified in object.
3) Mismatch between modulus in certificate and the value specified in object.
4) Mismatch between public exponent in certificate and the value specified in object.
5) Mismatch between x coordinate in certificate and the value specified in object.
6) Mismatch between y coordinate in certificate and the value specified in object.
7) Mismatch between curve in certificate and the value specified in object.
8) RSA load failed for specified certificate.
9) Elliptic curve load failed for specified certificate.
10) Elliptic Curve Point load failed for specified certificate.
11) Elliptic Curve group failed for specified certificate.
12) Elliptic Curve Group NID not supported.
13) Extraction of EC key coordinates failed.
14) Failed to allocate BIO for specified certificate.
15) Failed to write BIO for specified certificate.
16) Failed to get BIO memory pointer for specified certificate.
17) Certificate begin marker not found in certificate.
18) Certificate end marker not found in certificate.
19) Certificate file path does not exist.
20) OpenSSL API failed for certificate.
21) Certificate public key load failed.
22) Certificate key file path does not exist.
Impact:
The JWK configuration is not saved.
Recommended Action:
Change the incorrect values based on the error message and save the object.
01071c85 : (%s) key-type (%u) does not match certificate (%s) type (%u).
Location:
/var/log/ltm
Conditions:
While creating or modifying OAuth JWK Config, the prerequisite condition is the specification of certificate object and mismatched key-type value. Condition 1: The specified key-type is rsa , and providing a certificate of non-rsa type. OR Condition 2: The specified key-type is elliptic-curve, and providing a certificate of non-elliptic-curve type.
Impact:
The creation or modification of the OAuth JWK Config object would fail.
Recommended Action:
Provide the certificate of type matching the specified key-type value. If the provided certificate is of type rsa, specify key-type as rsa. Or if the provided certificate is of type elliptic-curve, specify key-type as elliptic-curve.
01071c86 : The %s must be provided in base64url encoded format for jwk-config (%s).
Location:
/var/log/ltm, GUI, TMSH console
Conditions:
If this occurs, some field in the JWK configuration, such as the shared-secret, the modulus, or the public-exponent, etc., is not properly encoded in BASE64URL format.
Impact:
It might indicate that the configuration is corrupted or manually entered incorrectly.
Recommended Action:
Enter the indicated field correctly. In case of data corruption, delete the JWK configuration, and recreate it from scratch, if necessary.
01071c87 : The claim name (%s) of claim (%s) cannot contain spaces.
Location:
/var/log/apm, TMSH, GUI
Conditions:
While creating or modifying an OAuth Claim object. This occurs when the claim name contains spaces.
Impact:
Object cannot be saved.
Recommended Action:
Choose a claim name without spaces while creating or modifying OAuth claim.
01071c88 : The word (%s) is a reserved word and cannot be used as claim name for the claim (%s).
Location:
/var/log/apm, TMSH
Conditions:
The word that is used as a claim name for OAuth Claim is a reserved word and must not be used.
Impact:
Object creation or modification will fail.
Recommended Action:
Use a different word as a claim name for OAuth Claim.
01071c89 : The %s claim name (%s) is already in use by agent %s for this entry.
Location:
/var/log/apm, TMSH
Conditions:
When the same claim is configured again for a particular entry in the OAuth Authorization agent.
Impact:
Object save will fail.
Recommended Action:
A claim can be configured only once for a particular entry in the OAuth Authorization agent.
01071c8a : The %s claim (%s) that is associated with the %s (%s) does not exist.
Location:
/var/log/apm, TMSH
Conditions:
The JWT access token claim that is specified either in the OAuth Client App or in the OAuth Profile is not created under OAuth Claim.
Impact:
Object save will fail.
Recommended Action:
Create the claim under OAuth claim before referencing in the OAuth Client App or OAuth Profile.
01071c8b : The %s claim name cannot be empty for OAuth Authorization agent %s.
Location:
/var/log/apm, TMSH, GUI
Conditions:
This error will occur when the oauth authorization agent contains a claim entry with empty claim name during creating or modification.
Impact:
The object will not be saved.
Recommended Action:
Create the oauth authz agent correctly by specifying claim name for the claim entry.
01071c8c : %s claim name (%s) associated with OAuth Authorization agent (%s) is not defined under OAuth claim.
Location:
/var/log/apm, TMSH
Conditions:
If the claim referenced in the OAuth Authorization agent is not created under OAuth Claim, this error will be seen.
Impact:
Object save will fail.
Recommended Action:
Create the claim under OAuth Claim first, and then it can be referenced in the OAuth Authorization agent.
01071c8d : %s cannot be empty because %s for %s (%s).
Location:
/var/log/ltm, GUI, TMSH console
Conditions:
The error happens when some field is required by the OAuth profile configuration and it is empty. For example, the Issuer field is required when JWT support is enabled, or the DB Instance field is required when opaque token support is enabled.
Impact:
Admin not able the enable JWT support or opaque token support if those required fields are missing.
Recommended Action:
Fill in those required fields as indicated in the error message.
01071c8e : %s in %s (%s) is not an allowed URL: %s
Location:
/var/log/ltm, GUI, TMSH console
Conditions:
The error happens when the admin enters a mal-formatted URL for a field that requires a URL, such as the Issuer in an OAuth profile.
Impact:
None.
Recommended Action:
The admin should fix his URL to be a properly formatted URL.
01071c8f : The %s (%s) associated to %s (%s) is not a valid %s.
Location:
/var/log/ltm
Conditions:
Either the OAuth profile name or the JWK config name under Additional JWK for JWKS URI setting is invalid.
Impact:
Change the key use setting in the JWK configuration in the OAuth profile to signing.
Recommended Action:
Make sure that the JWK configuration under Additional JWK for JWKS URI setting in the OAuth profile exists in the JWK configuration list.
01071c90 : JWT config %s to be associated with JWK config (allowed keys) %s does not exist.
Location:
/var/log/apm, GUI, CLI
Conditions:
Allowed keys are configured for an invalid JWT config.
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
Configure allowed keys for a valid JWT config and save the object.
01071c91 : In JWT config %s, allowed keys '%s' do not exist. Use a valid JWK config for allowed keys.
Location:
/var/log/apm, GUI, CLI
Conditions:
An invalid JWK configuration is used for allowed keys in a JWT config.
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
Use a valid JWK configuration for allowed keys and save the object.
01071c92 : In JWT config (%s), the same JWK config (%s) is present in both allowed keys and blocked keys. This is not allowed.
Location:
/var/log/apm, GUI, CLI
Conditions:
The same JWK configuration is present in both allowed keys and blocked keys in JWT Config.
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
Remove the duplicate JWK configuration from allowed keys or blocked keys in JWT Config and save the object.
01071c93 : JWT config %s to be associated with JWK config (blocked keys) %s does not exist.
Location:
/var/log/ltm, CLI
Conditions:
Blocked keys are associated with an invalid JWT Config.
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
Configure blocked keys for a valid JWT Config and save the object.
01071c94 : In JWT config (%s), blocked keys '%s' do not exist. Use a valid JWK config for blocked keys
Location:
/var/log/apm, GUI, CLI
Conditions:
An invalid JWK config is used for blocked keys in JWT Config.
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
Use a valid JWK Config to configure blocked keys in JWT Config and save the object.
01071c95 : JWT Provider List %s to be associated with OAuth Provider %s does not exist.
Location:
/var/log/apm, GUI, CLI
Conditions:
There is an OAuth provider configuration for an invalid JWT provider List.
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
Try to configure OAuth Provider in a valid JWT Provider List only and then save the configuration.
01071c96 : In JWT Provider List %s, OAuth Provider %s does not exist. Use a valid OAuth Provider for providers attribute.
Location:
/var/log/apm, GUI, CLI
Conditions:
An invalid OAuth Provider is configured for the providers attribute in JWT Provider List.
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
Use a valid OAuth Provider for the providers attribute in JWT Provider List and save the object.
01071c97 : Error generating JWT encryption key using secret.
Location:
/var/log/ltm, GUI, TMSH console
Conditions:
This error occurs when an openssl function (not F5 software), PKCS5_PBKDF2_HMAC_SHA1, failed.
Impact:
The admin should never see this error. If it really happens, it is possible that the OS environment/file system might be corrupted.
Recommended Action:
Suggest the admin to try again. If the same error occurs, restart the BIG-IP system. If the same error still occurs, reinstall the software image.
01071c98 : The JWK config (%s) associated to %s (%s) can contain public key types only (such as, rsa, elliptic-curve).
Location:
/var/log/ltm
Conditions:
Under OAuth profile settings, rotation-key(tmui) or additional-jwk-for-jwks-uri(tmsh) includes a JWK config pointing to non public-key type and/or algorithm. Using JWK config with 'octet' key-type will lead to this configuration error.
Impact:
Configuration changes leading to this error will remain ineffective.
Recommended Action:
For rotation-key(tmui) or additional-jwk-for-jwks-uri(tmsh) use JWK config containing public key-type or algorithm. This includes RSA, Elliptic-Curve key types/algorithms.
01071c99 : The OAuth profile (%s) does not allow JWK config (%s) with duplicate key-id (%s) of type (%s).
Location:
/var/log/ltm
Conditions:
OAuth profile allows configuring the JWK config, and additional JWK for JWKS URI config for JWKS URI. If the entries configured in these entries contains a JWK setting with the same key-id and algorithm type, this error will be shown.
Impact:
Configuration changes leading to this error will remain ineffective.
Recommended Action:
* Disassociate all JWK settings containing a duplicate key-id mentioned in the error that is attached to one of JWK or additional JWK setting on OAuth profile.
* Modify the key-id of the JWK config mentioned in the error message leading to this error.
01071c9a : The JWK config (%s) containing algorithm (%s) does not match key type (%s).
Location:
/var/log/ltm
Conditions:
The signing algorithm in a given JWK config doesn't match the selected key-type.
Impact:
Configuration changes leading to this error will remain ineffective.
Recommended Action:
* For key-type rsa, valid algorithm types can be RS256, RS384 or RS512
* For key-type octet, valid algorithm types can be HS256, HS384 or HS512
* For key-type elliptic-curve, valid algorithm types can be ES256, ES384
01071c9b : The JWK config (%s) associated to %s (%s) contains an invalid signing algorithm.
Location:
/var/log/ltm
Conditions:
The JWK config assigned to the OAuth profile includes invalid signing algorithm (none).
Impact:
Configuration changes leading to this error will remain ineffective.
Recommended Action:
A JWK config containing a 'none' signing algorithm is not allowed to be assigned to OAuth profile. Change JWK config signing algorithm to RS, HS, or ES type signing algorithms to get past this error.
01071c9c : The JWK config (%s) associated to %s (%s) can only be used for signing.
Location:
/var/log/ltm
Conditions:
The JWK config in the OAuth profile contains key use setting set to encryption. At this time, only signing is supported for key usage.
Impact:
Configuration changes leading to this error will remain ineffective.
Recommended Action:
Change key use setting in the JWK config in the OAuth profile to signing.
01071c9d : The JWK config (%s) associated to %s (%s) requires certificate key configuration.
Location:
/var/log/ltm
Conditions:
A JWK config can be created without specifying a certificate-key value. However, a JWK config without certificate-key cannot be used by a OAuth profile for token signing. A JWK config used by OAuth AS must contain certificate-key value.
Impact:
Configuration changes leading to this error will remain ineffective.
Recommended Action:
Fix the JWK config to contain a certificate-key value, and then associate the created JWK config to the OAuth profile for JWT signing.
01071c9e : The encryption secret is needed to generate an encryption key for OAuth profile (%s).
Location:
/var/log/ltm, GUI, TMSH console
Conditions:
When the admin enables the JWT support for the first time in an OAuth profile, and does not provide an encryption secret, this error occurs.
Impact:
The JWT support will not be enabled. If it is the creation of an OAuth profile, the profile will not be created.
Recommended Action:
The admin should give an non-empty encryption secret.
01071c9f : Allowed signing algorithms list cannot be empty in JWT config (%s) for Issuer (%s).
Location:
/var/log/apm, TMSH, GUI
Conditions:
Allowed signing algorithms list has been left empty.
Impact:
Object save and Configuration load will fail.
Recommended Action:
Move one algorithm at least to allowed signing algorithms.
01071ca0 : When the %s flag is enabled, OAuth Provider (%s) must have %s JWT config attached for the JWT provider list (%s)
Location:
/var/log/ltm, GUI, CLI
Conditions:
The JWT config is not attached to a provider (manual or auto depending on flag) before being added to the JWT provider list.
Impact:
The command to add the provider to the JWT Provider List fails.
Recommended Action:
Attach the JWT config to a provider (either manually or by auto-discovery) before adding it to the JWT provider list.
01071ca1 : The JWK config (%s) associated to %s (%s) was auto-generated and is meant for Client/Resource Server purposes only.
Location:
/var/log/apm, TMSH
Conditions:
If an auto-discovered key is being referenced by an OAuth profile, this error will be seen.
Impact:
Object save will fail.
Recommended Action:
This key can be used only by Client/RS configuration.
01071ca2 : When jwt-token is enabled, a JWK config must be assigned as the Primary Key for OAuth Profile (%s).
Location:
/var/log/apm, TMSH, GUI
Conditions:
If the attribute primary-key is not filled while creating/modifying an OAuth Profile, and JWT token flag is enabled.
Impact:
Will not let you save without this value.
Recommended Action:
Assign a JWK to primary key.
01071ca3 : Error loading cert-chain (%s) associated to JWK config (%s)%s
Location:
/var/log/ltm
Conditions:
A certificate chain setting in the JWK config contains an invalid entry or the certificate chain contents are invalid.
Impact:
Configuration changes leading to this error will remain ineffective.
Recommended Action:
Make sure that the certificate chain associated in the JWK-config exists in the BIG-IP certificate store. Check Traffic Certificate management under 'System -> Certificate Management' in the GUI to make sure. If the certificate chain does exist, make sure that the certificate-chain contents are valid.
01071ca4 : Invalid certificate order within cert-chain (%s) associated to JWK config (%s).
Location:
/var/log/ltm
Conditions:
In a given JWK config, if a cert-chain input is specified, the chain should contain the certificate of the issuer of the cert provided in the cert input. If cert-chain is a bundle, that is, it contains multiple certificates, then every subsequent certificate should be the issuer of the previous certificate.
If the certificate bundle contains multiple certificates, but the issuer is not in order, it will lead to this error.
Impact:
Configuration changes leading to this error will remain ineffective.
Recommended Action:
Fix the order of certificate(s) in the cert-chain input file so that the 'cert' input certificate issuer is present in the cert-chain file, and each next certificate contains the issuer of the previously issued certificate.
Here is an example of a valid cert/cert-chain config:
cert input contains:
CN = as-cert.com
issuer = intermediate-level3-cert.com
cert-chain input contains:
1st CN = intermediate-level3-cert.com
1st issuer = intermediate-level2-cert.com
---------------------------
2nd CN = intermediate-level2-cert.com
2nd issuer = intermediate-level1-cert.com
---------------------------
1st CN = intermediate-level1-cert.com
3rd issuer = root-cert.com
---------------------------
01071ca5 : The JWK config (%s) associated to OAuth %s (%s) failed trust verification with trusted CA bundle (%s).
Location:
/var/log/ltm
Conditions:
This is a common error for OAuth profile or OAuth provider page.
The JWK config, associated with a OAuth profile or provider, contains a certificate, certificate-chain, and trusted-ca bundle assigned to the OAuth profile or provider that failed a trust verification check. A trust verification check means that the certificate issuer is included within certificate-chain and that the issuer for certificate-chain is included in the trusted-ca bundle.
Impact:
Configuration changes leading to this error will remain ineffective.
Recommended Action:
* If a JWK config contains only a certificate, make sure to include the certificate issuer in the trusted-ca bundle.
* If a JWK config includes a certificate-chain, make sure that the certificate issuer is included in the certificate-chain. If there are multiple certificates in the certificate-chain, the issuer for all of the certificates must exist within the certificate-chain, except the last certificate. A certificate issuer for the last certificate-chain must be part of trusted-ca bundle.
01071ca6 : Only '%s' token validation mode is allowed for OAuth %s agent '%s'.
Location:
/var/log/ltm, tmsh
Conditions:
Misconfiguration.
Admin attempts to configure token-validation-mode for Oauth Client Agent as something other than 'External' in tmsh. The error indicates that this configuration is not valid.
Impact:
This is mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
Allowed token-validation-mode ('External') must be configured for Oauth client agent.
01071ca7 : JSON web token '%s' already exists in Provider List '%s'. The change you are trying to make is not allowed because it would result in a provider list that contains more than one instance of the same JSON web token.
Location:
/var/log/ltm, tmsh, GUI
Conditions:
Misconfiguration.
Admin attempts to add a Provider to a Provider list when the Provider has JWT config associatedm and the Provider list already has the same JWT config associated through some other Provider in the list. All the JWT configs associated with a Provider list must be unique.
Impact:
This is mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
When attempting to add a Provider to a Provider list, check that the operation will not result in a Provider list with more than one instance of the same JWT config.
01071ca8 : JSON web key '%s' already exists in Provider List '%s'. The change you are trying to make is not allowed because it would result in a provider list that contains more than one instance of the same JSON web key.
Location:
/var/log/ltm, tmsh, GUI
Conditions:
Misconfiguration.
Admin attempts to add a Provider to a Provider list when the Provider has JWK config(s) associated and the Provider list already has the same JWK config(s) associated through some other Provider in the list. All the JWK configs associated with a Provider list must be unique.
Impact:
This is mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
When attempting to add a Provider to a Provider list, check that the operation will not result in a Provider list with more than one instance of the same JWK config.
01071ca9 : OAuth parent profile's jwt-refresh-token-enc-secret attribute cannot be modified.
Location:
/var/log/apm, TMSH
Conditions:
If OAuth profile's jwt-refresh-token-enc-secret is modified from TMSH.
Impact:
A validation exception is seen.
Recommended Action:
Do not specify jwt-refresh-token-enc-secret for parent profile.
01071caa : The encryption key for OAuth profile (%s) cannot be specified directly. Use encryption secret to generate a new encryption key and make sure that jwt-token is enabled.
Location:
/var/log/apm, TMSH
Conditions:
If jwt-refresh-token-enc-key is specified directly.
Impact:
Object save will fail.
Recommended Action:
Do not specify jwt-refresh-token-enc-key. Instead use jwt-refresh-token-enc-secret to generate key.
01071cab : The JWK config (%s) associated to %s (%s) requires key ID configuration.
Location:
/var/log/ltm, GUI, TMSH console
Conditions:
The JWK does not have an ID configured. This JWK can be used in a client but not in an AS. Associating the JWK with an OAuth profile is intended to use it in an AS.
Impact:
The admin cannot associate this JWK to the OAuth profile without changing the JWK configuration.
Recommended Action:
The admin can give the JWK an ID, or use another JWK that already has an ID.
01071cac : When more than one JWK config of key-type '%s' is present in a JWT config, all the keys of that key-type must have key-id or cert-thumbprint-sha1 or cert-thumbprint-sha256 present.
Location:
/var/log/ltm, tmsh, GUI
Conditions:
Misconfiguration.
An admin attempts to add a JWK config to a JWT config, resulting in the JWT config having more than one JWK config of the same key-type, and not all the JWK configs of that key-type have key-id, cert-thumbprint-sha1, or cert-thumbprint-sha256 present.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
When more than one JWK config of the same key-type is associated with a JWT config, all these JWK configs must have key-id, cert-thumbprint-sha1, or cert-thumbprint-sha256 present.
01071cad : All the JWK configs in a JWT config must have unique key-id for each key-type. The key-id '%s' for key-type '%s' is already present in JWT config '%s'.
Location:
/var/log/ltm, tmsh, GUI
Conditions:
Misconfiguration.
Admin attempts to add a JWK config to a JWT config, and the JWK config has pair (key-id, key-type) that is already present in the JWT config through some other JWK config. The pair (key-id, key-type) must be unique within a JWT config.
Impact:
This is mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
When attempting to add a JWK config to a JWT config, check that the operation will not result in a JWT config with more than one instance of the same pair (key-id, key-type).
01071cae : %s (%s) for OAuth profile (%s) should be unique across other OAuth Authorization Server endpoints.
Location:
TMSH
Conditions:
When the oauth endpoints are configured to be the same, this warning will be seen.
Impact:
The object is saved, however the OAuth AS functionality will be affected.
Recommended Action:
Configure different values for Authorization server endpoints.
01071caf : The issuer cannot be modified for autodiscovered JWT config '%s'.
Location:
/var/log/ltm, tmsh
Conditions:
Modification error.
Admin attempts to modify issuer attribute of an auto-discovered JWT config in tmsh. This operation is not allowed.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
None.
01071cb0 : Cannot enable Real-Time Encryption when a custom encryption function is specified in the Anti-Fraud URL '%s'.
Location:
/var/log/ltm, GUI
Conditions:
Improper FPS profile configuration.
Impact:
Configuration will not load.
Recommended Action:
Either disable a custom encryption function or enable Real-Time Encryption.
01071cb0 : For autodiscovered JWT config '%s', you can move algorithms between the allowed and blocked lists only.
Location:
/var/log/ltm, tmsh
Conditions:
Misconfiguration.
Admin attempts to modify the allowed-algorithms or blocked-algorithms of an auto-discovered JWT config, by either adding a new algorithm that was not previously present in either of the two lists, or by removing an algorithm from either of the two lists without adding that algorithm to the other list.
For auto-discovered JWT config, the algorithms can be moved between allowed and blocked lists only.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
For auto-discovered JWT config, the algorithms can be moved between allowed and blocked lists only.
01071cb1 : JWK config '%s' is autodiscovered, JWT config '%s' is not. An autodiscovered JWK config can be added to an autodiscovered JWT config only.
Location:
/var/log/ltm, tmsh
Conditions:
Misconfiguration.
Admin attempts to add an auto-discovered JWK config to a manual JWT config. An auto-discovered JWK config can be associated with an auto-discovered JWT config only.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
This operation is not allowed. Auto-discovered JWK config cannot be added to manual JWT config.
01071cb2 : For autodiscovered JWT config '%s', you can move autodiscovered keys between the allowed and blocked lists only.
Location:
/var/log/ltm, tmsh
Conditions:
Misconfiguration.
Admin attempts to modify the allowed-keys or blocked-keys of an auto-discovered JWT config, by either adding a new key that was not previously present in either of the two lists, or by removing a key from either of the two lists without adding that key to the other list.
For auto-discovered JWT config, the keys can be moved between allowed and blocked lists only.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
For auto-discovered JWT config, the keys can be moved between allowed and blocked lists only.
01071cb3 : Autodiscovered JWK config '%s' cannot be modified.
Location:
/var/log/ltm, tmsh
Conditions:
Modification error.
Admin attempts to modify an attribute of an auto-discovered JWK config in tmsh. This operation is not allowed.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
None.
01071cb4 : Autodiscovered JWT config cannot be modified for OAuth Provider '%s'.
Location:
/var/log/ltm, tmsh
Conditions:
Modification error.
Admin attempts to modify auto-jwt-config-name of a Provider in tmsh. This operation is not allowed.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
None.
01071cb5 : Autodiscovered JWT config '%s' is associated with OAuth Provider '%s'. It cannot be added to Provider '%s'.
Location:
/var/log/ltm, tmsh
Conditions:
Misconfiguration.
Admin attempts to add an auto-discovered JWT config to a Provider, and the JWT config is already associated with another Provider. An auto-discovered JWT config is bound to one Provider and cannot be added to another Provider.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
Auto-discovered JWT config needs to be discovered on TMUI to be associated with a Provider.
01071cb6 : Support for at least Opaque or JWT token should be enabled for OAuth profile (%s).
Location:
/var/log/ltm, tmsh, GUI
Conditions:
This occurs when support for both an opaque and jwt token is disabled.
Impact:
Object save will fail.
Recommended Action:
Enable support for at least an opaque token or jwt token.
01071cb7 : The auto-generated attribute for %s '%s' cannot be modified.
Location:
/var/log/ltm, tmsh
Conditions:
Modification error.
Admin attempts to modify the 'auto-generated' attribute of a JWT config or a JWK config in tmsh. This operation is not allowed.
Impact:
This is an mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
None.
01071cb8 : The auto-generated attribute for %s '%s' cannot be specified.
Location:
/var/log/ltm, tmsh
Conditions:
Misconfiguration.
Admin specifies an 'auto-generated' attribute while creating a new JWT config, or a JWK config in tmsh. This is not allowed as the value for this field is populated automatically.
Impact:
This is an mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
Auto-generated attribute should not be specified while creating a new JWT config or JWK config.
01071cb9 : Claim value cannot be empty for OAuth claim (%s).
Location:
/var/log/apm, TMSH
Conditions:
When the claim value is empty in the OAuth Claim.
Impact:
Object save will fail.
Recommended Action:
Configure claim value in OAuth Claim.
01071cba : %s claim value associated with OAuth claim (%s) cannot be empty for OAuth Authorization agent %s, entry %d.
Location:
/var/log/apm, TMSH
Conditions:
In the OAuth Authorization agent, the claim value of the OAuth Claim is empty.
Impact:
Object save will fail.
Recommended Action:
Configure claim value in the Claim that is configured in the OAuth Authorization agent.
01071cbb : The JWK config (%s) containing algorithm (%s) does not match curve (%s) for elliptic-curve.
Location:
/var/log/apm, TMSH
Conditions:
When the algorithm specified in the JWK config does not match with the curve. When algorithm is ES256, curve value must be P-256. When algorithm is ES384, curve value must be P-384. Any other combination is invalid.
Impact:
Object save will fail.
Recommended Action:
In the JWK config, when algorithm is ES256, configure curve value P-256. When algorithm is ES384, curve value of P-384 must be configured. Any other combination is invalid.
01071cbc : The last-discovery-time cannot be specified while creating Provider '%s'.
Location:
/var/log/ltm, tmsh
Conditions:
Misconfiguration.
Admin specifies a 'last-discovery-time' attribute while creating a new OAuth Provider in tmsh. This is not allowed as the value for this field is populated automatically.
Impact:
This is an mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
The 'last-discovery-time' attribute should not be specified while creating a new OAuth Provider in tmsh as this will be populated automatically.
01071cbd : The last-discovery-time cannot be modified for Provider '%s'.
Location:
/var/log/ltm, tmsh
Conditions:
Modification error.
Admin attempts to modify a 'last-discovery-time' attribute of an OAuth Provider in tmsh. This operation is not allowed.
Impact:
This is an mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
The 'last-discovery-time' is updated on discovering auto JWT config/JWK config on TMUI. It is not allowed to modify this field in tmsh.
01071cbe : When use auto JWT config is enabled, OAuth Provider (%s) must have trusted CA present.
Location:
/var/log/ltm, tmsh
Conditions:
Misconfiguration.
An admin attempts to create an OAuth Provider with the default value 'true' for attribute use-auto-jwt-config, and does not specify trusted-ca-bundle.
Or, an admin attempts to set the value for trusted-ca-bundle to 'none' for an OAuth Provider that has the value 'true' for use-auto-jwt-config.
Impact:
This is an mcp configuration error. The object containing this configuration will not be saved.
Recommended Action:
For an Oauth Provider with use-auto-jwt-config=true, trusted-ca-bundle is a mandatory field.
01071cbf : The JWK Config (%s) cert field cannot be empty if cert-key (%s) is specified.
Location:
CLI
Conditions:
The certificate key reference field is filled in but not the certificate field itself.
Impact:
The object cannot be saved.
Recommended Action:
Either attach a certificate along with the key, or use the modulus/exponent/x/y/curve fields.
01071cc0 : %s (%s): Traffic Scrubbing Advertisement Duration must be more than zero.
Location:
/var/log/ltm
Conditions:
A DoS Profile is configured with Application enabled and Traffic Scrubbing Advertisement Duration is set to 0.
Impact:
DoS profile changes are not saved.
Recommended Action:
Set the value to a value more than zero.
01071cc1 : %s (%s): RTBH Advertisement Duration must be more than zero.
Location:
/var/log/ltm
Conditions:
A DoS Profile is configured with Application enabled and RTBH Advertisement Duration is set to 0.
Impact:
DoS profile changes are not saved.
Recommended Action:
Set the value to a value more than zero.
01071cc2 : Cannot enable both %s and %s for parameter '%s' in the Anti-Fraud profile '%s' (Anti-Fraud URL: '%s').
Location:
/var/log/ltm
Conditions:
Both "substitute value" and "check integrity" are enabled in an anti-fraud parameter.
Impact:
The configuration will not load.
Recommended Action:
Disable either of the 'substitute value' or 'check integrity' check boxes for the given parameter.
01071cca : Dos Signature (%s): %s is not user settable field.
Location:
/var/log/ltm, TMSH, GUI
Conditions:
This message will happen when user is trying to change unchangeable field of Dos Signature Configuration.
Impact:
The configuration is not changed.
Recommended Action:
None.
01071ccb : %s (%s): Attacked dst can not be enabled if per-destination detection/limit pps is less than 0.1%% of the corresponding vector setting.
Location:
/var/log/ltm
Conditions:
The per-source detection/limit pps is less than 1 percent of the corresponding value of the DoS vector. The DoS vector is specified by the configuration value of the rate threshold/rate limit in the DoS vector.
Impact:
The security DoS DNS/SIP/NETWORK/Device attack vector attacked dst cannot be enabled.
Recommended Action:
Change the configuration settings of attack vector for either the per-source detection/limit pps or the rate threshold/rate limit.
01071ccc : %s (%s): Attacked dst per-destination detection/limit pps cannot be greater than the corresponding vector setting.
Location:
/var/log/ltm
Conditions:
The per-source detection/limit packets per second is greater than the corresponding DoS vector specified in the value of the rate threshold/rate limit.
Impact:
Security DoS DNS/SIP/NETWORK/Device attack vector attacked dst actor cannot be enabled.
Recommended Action:
Change the configuration settings of the attack vector for either per-source detection/limit pps or rate threshold/rate limit.
01071cd4 : %s: %s can't be deleted because %s.
Location:
/var/log/ltm, GUI, console
Conditions:
When a configuration object is not allowed to be deleted, the error message is triggered.
Impact:
No update to the related configuration.
Recommended Action:
None.
01071cd5 : %s: %s can't be modified because %s.
Location:
/var/log/ltm, GUI, console
Conditions:
When modification to a configuration object is not allowed, the error message is triggered.
Impact:
No update to the related configuration.
Recommended Action:
None.
01071cd6 : Dos Signature (%s): %s is not allowed to be reset by user once it is specified.
Location:
/var/log/ltm, console, GUI
Conditions:
This message will happen when user is trying to reset unresettable field of Dos Signature Configuration.
Impact:
The configuration is not changed.
Recommended Action:
None.
01071cd9 : Field-list contains an invalid/duplicate value.
Location:
CLI
Conditions:
An attempt has been made to add an invalid field to the field-list when creating a security log profile.
Impact:
The CLI displays an error message when creating the security log profile:
root@(cfg-sync Standalone)(autodosd DOWN)(/Common)(tmos)# create security log profile test nat {format { end-inbound-session { type field-list field-list {context_name src_ip dest_ip test } user-defined [TEST] }}}
01071bf2:3: Field-list contains an invalid/duplicate value.The message indicates an invalid field configuration. After removing the invalid field, log profile can be created/modified.
Recommended Action:
Remove the invalid field.
01071cdc : Security static PAT %s translation object '%s' address (%s) is overlapping with another address (%s) located in '%s' PAT %s translation object.
Location:
GUI, CLI
Conditions:
A security static PAT translation object contains an overlapping address with another static PAT translation object address.
Impact:
An error message is displayed and the configuration is not applied.
Recommended Action:
Remove the overlapping address/address range from the configuration.
01071cdd : Traffic-group (%s) is referenced by security NAT Policy (%s) and cannot be deleted.
Location:
/var/log/ltm
Conditions:
An attempt was made to delete a traffic group that is being referenced by a security NAT policy object.
Impact:
The operation to delete the traffic group failed.
Recommended Action:
The referenced security NAT policy object must be deleted first. Then the traffic group can be deleted.
01071cde : Traffic-group (%s) is referenced by security source translation (%s) and cannot be deleted.
Location:
/var/log/ltm
Conditions:
An attempt was made to delete a traffic group that is being referenced by a security source translation object.
Impact:
The operation to delete the traffic group will fail.
Recommended Action:
The referenced security source translation object must be deleted first. Then the traffic group can be deleted.
01071cdf : %s (%s): Dos vector (%s) does not support Attacked destination DOS attack detection.
Location:
var/log/ltm
Conditions:
Certain dos vectors do not support attacked destination detection because they are error or drop vectors for which the system does not process traffic and drop packets. Do not configure for an attacked destination.
Impact:
Not an error or defect; this is an informational type message for the user.
Recommended Action:
None.
01071ce3 : %s (%s) cannot be set to (%s) when %s (%s) is set to (%s)
Location:
/var/log/ltm, GUI, console.
Conditions:
This is a generic error message describing a validation constraint across two different objects' value(s).
The objects can be:
1) of the same type
2) different types
3) the same instance
The constraint can be:
1) over the same property
2) over different properties
The specialization of this template should tell you which object classes and specific properties it is referring to.
Impact:
Validation error.
Recommended Action:
None.
01071ce4 : %s (%s): %s feature is not supported for %s attack type.
Location:
/var/log/ltm, console, GUI
Conditions:
This will happen when configuring Dos Attack for a feature that is not supported with the specified attack type.
Impact:
The configuration in the system will not be changed.
Recommended Action:
None.
01071ce5 : %s (%s): %s cannot be enabled if %s is not enabled for %s attack type.
Location:
/var/log/ltm, console, GUI
Conditions:
This will happen when enabling a Dos Attack feature that depends on a condition that is not satisfied.
Impact:
The configuration in the system is not changed.
Recommended Action:
None.
01071ce6 : The value (%s) is invalid. Valid TTL is %s.
Location:
GUI, console
Conditions:
The error message displays if a user attempts to configure the scrubber advertisement tel and the values are not in a valid range.
Impact:
Configuration of the scrubber TTL fails unless you change one of the allowed values for the TTL.
Recommended Action:
None.
01071ce7 : Cannot configure Advertisement TTL while scrubbing is in progress.
Location:
GUI, console
Conditions:
The user is attempting to modify the scrubber advertisement TTL, while the scrubber action is already in progress for one of the monitored objects.
Impact:
Modification of the scrubber advertisement TTL will fail, unless the user configures this value once the scrubbing action is done for all the monitored objects.
Recommended Action:
None.
01071ce8 : The VLAN %s has the same tag %u as VLAN %s. So the port-fwd-mode of the interface associated with the VLAN must be set to l2wire.
Location:
/var/log/ltm
Conditions:
The configuration is invalid. If an interface is added to a 'virtual wire' VLAN, the forwarding mode of the interface cannot be changed to the value other than 'virtual wire'.
Impact:
None.
Recommended Action:
Remove the interface from the VLAN before changing the forwarding mode property of the interface.
01071ce8 : The VLAN (%s) has the same tag %u as VLAN (%s). So the port-fwd-mode of the interface associated with the VLAN must be set to virtual-wire.
Location:
/var/log/ltm
Conditions:
This message is caused by an invalid configuration. If an interface is added to a 'virtual-wire' vlan, the port-fwd-mode cannot be changed to the value other than 'virtual-wire'.
Impact:
None.
Recommended Action:
Remove the interface from VLAN before changing the port-fwd-mode property.
01071ce9 : The Scrubber Route Domain (%s) has a destination IP (%s) that overlaps with (%s).
Location:
/var/log/ltm, console, GUI
Conditions:
When attempting to configure a scrubber-rd-network in scrubber-rt-domain, its destination IP must not overlap with other scrubber-rd-networks within the same scrubber-rt-domain.
Impact:
Validation failure.
Recommended Action:
Choose a different value.
01071ceb : Operation failed for CA bundle manager %s due to other pending operation.
Location:
/var/log/ltm
Conditions:
When a ca-bundle manager is updated more than once over a very short period of time, the keymgmtd will see two concurrent updates to the ca-bundle manager.
Impact:
The second update operation will be rejected.
Recommended Action:
Successive update to the same ca-bundle manager needs to be separated by a short time period. In most update operations, this error log will not be encountered.
01071cec : Ignoring unknown tag (%u) in %s message.
Location:
/var/log/ltm
Conditions:
High availability (HA) communication is happening with another device that sends a tag that this device does not recognize.
Although this should never happen, it might occur when the software versions differ on the devices in the HA configuration.
Impact:
The unknown tag field is ignored.
Recommended Action:
These two versions are incompatible, so they cannot communicate by DSC. Ensure that all devices are running the same version.
01071ced : MQTT monitor '%s' must have a username when password is configured.
Location:
/var/log/ltm, console, GUI
Conditions:
The message appears for a missing username in MQTT monitor when a password is configured.
01071c73:3: MQTT monitor '/Common/mon-mqtt-1.2' must have a username when password is configured.
MQTT monitor is created and it has a 'password' field filled in while 'username' field remains empty (having value "none" in tmsh).
Impact:
Submitting configuration of MQTT monitor is not accepted.
Recommended Action:
Have a non-empty value for 'username' field in the MQTT monitor when username and password credentials are required.
01071cee : Virtual %s cannot use FastL4 hash persistence profile %s when protocol is not TCP.
Location:
/var/log/ltm, tmsh, GUI
Conditions:
You attempt to configure a FastL4 virtual server with an IP-protocol other than TCP, and then and add the hash persistence profile.
Impact:
FastL4 virtual servers when configured with IP protocol other than TCP do not support hash persistence profile configurations.
Recommended Action:
Do not configure non-TCP FastL4 with hash persistence. Use other type of virtual server if hash persistence is required.
01071cef : Policy (%s) of type %s cannot have subroutine-properties attached, policy type must be %s.
Location:
/var/log/ltm
Conditions:
This message is generated when an attempt is made to attach a subroutine to an access policy that is not of type "subroutine".
Impact:
The system cannot perform the requested operation of attaching the subroutine to a policy.
Recommended Action:
Create a policy of type "subroutine".
01071cf0 : DNS resolver must be configured for SAML metadata automation object (%s).
Location:
/var/log/ltm, VPE UI, tmsh
Conditions:
Administrator attempts to configure 'connection-properties' attribute of SAML metadata automation object. Administrator has not specified required DNS resolver in 'connection-properties' resulting in the validation error.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
Specify DNS resolver in connection-properties attribute of SAML metadata automation object.
01071cf1 : SAML metadata automation object (%s) should have only one 'connection-properties' attribute configured.
Location:
/var/log/ltm, VPE UI, tmsh
Conditions:
Administrator attempts to configure SAML metadata automation object, and set more then one property 'connection-properties'.
Only a single 'connection-properties' configuration is allowed per SAML metadata automation object, so the error will be shown.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
Configure only one 'connection-properties' attribute per SAML metadata automation object.
01071cf2 : apm sso saml (%s) contains empty value in saml-attribute (%s).
Location:
/var/log/ltm, VPE UI, tmsh
Conditions:
BIG-IP system Administrator attempts to configure APM SSO SAML object. List of attributes is included in this object. The Administrator has specified an empty value for one of the attributes.
Impact:
This is an mcp configuration error. The object containing this configuration is not saved.
Recommended Action:
Remove empty values from SAML attribute of the APM SSO SAML object.
01071cf3 : Authorize redirect request (%s) must always use 'GET' method.
Location:
Console.
Conditions:
If an authorize redirect request is created with POST method, then this message displays
Impact:
Create the OAuth Request object fails.
Recommended Action:
Create authorize redirect request only with 'GET' method.
01071cf4 : Invalid %s for Monitor Test (%s) conflicts with monitor value (%s)
Location:
/var/log/ltm, tmsh, iControl REST
Conditions:
One or more of the parameters specified in the tmsh 'run ltm monitor' command to test an LTM monitor configuration are incorrect.
Specifically, the destination IP Address and/or Service Port are specified in the 'run ltm monitor' command, when the destination IP Address and/or Service Port are already specified in the LTM health monitor configuration being tested.
Impact:
A potentially-invalid or misleading monitor test is prevented from running.
If the destination IP Address and/or Service Port of an LTM health monitor is configured, that configuration will be used during the monitor test.
Preventing conflicting destination IP Address and/or Service Port parameters from being specified in the tmsh 'run ltm monitor' command helps ensure accuracy of the monitor test, and fidelity with actual behavior of the LTM health monitor as configured once assigned to an LTM node, pool member or pool.
Recommended Action:
When performing a test of an LTM monitor using the tmsh 'run ltm monitor' command, only provide destination IP Address and/or Service Port parameters which are not already configured in the LTM health monitor being tested.
01071cf5 : Invalid state (%s) for Monitor Test target (%s) marked for cleanup
Location:
/var/log/ltm
Conditions:
A monitor instance created internally for the purpose of executing the tmsh 'run ltm monitor' command (to test LTM health monitor configuration) was found to be in an unexpected state.
Impact:
The LTM monitor test result cannot be evaluated accurately.
This condition results from an invalid internal state in mcpd and/or bigd daemon processing. Therefore, it might be an indication of more significant inconsistencies within the BIG-IP configuration subsystem.
Recommended Action:
Further diagnosis of the mcpd and bigd daemons is indicated, including enabling mcpd and bigd debug logging and repeating the LTM monitor test which encountered the error condition.
01071cf6 : The current provisioning does not support the TurboFlex profile. Please provision LTM first or choose another profile suggested on the help page.
Location:
/var/log/ltm
Conditions:
TurboFlex profiles need certain provisioning to be configured. Different TurboFlex profiles have different requirements, but all of them can be configured when LTM is provisioned.
Impact:
When the user selects a TurboFlex profile, the profile does not become the active profile.
Recommended Action:
Provision LTM or other modules that support the chosen TurboFlex profile listed under the description of each profile. (The TMSH command is "show sys turboflex profile all field-fmt".)
01071cf7 : The chosen turboflex is not licensed, therefore the change cannot be made.
Location:
/var/log/ltm, GUI, tmsh
Conditions:
This only happens when the user is trying to change the active TurboFlex profile. If the user has an unthrottled license, which is also called a PAYG standard license, some TurboFlex profile will not be licensed. Therefore, choosing the unlicensed profile will trigger this message, and the change will not be made.
Impact:
The change of the desired TurboFlex profile will not be done.
Recommended Action:
If you would like the TurboFlex profile, you will need to upgrade the license from unthrottled to throttled, in other words, from PAYG standard to PAYG performance.
01071cf9 : The provision module %s requires TurboFlex profile %s. Please either un-provision the module or choose the required profile. For more information, please see 'tmsh help sys turboflex' on the command line, or look at the 'Help' tab on the TurboFlex page under Resource Provisioning.
Location:
/var/log/ltm, GUI
Conditions:
Some provisioning module can only be provisioned when a certain TurboFlex profile is set as active. Therefore, this error will appear when you are trying to provision a module when the required TurboFlex profile is not active, or when you are switching to another TurboFlex profile that does not allow a provisioned module to be provisioned that the previous profile allowed.
Impact:
The modifying action will not be done.
Recommended Action:
The error message will tell you which profile to modify with the command "tmsh modify sys turboflex profile-config type <profile>", or which modules to un-provision with command "modify sys provision <module> level none", in order for the change to occur without error.
01071cfb : Please get the Advanced Protocols or FIX add-on license to enable FIX features.
Location:
/var/log/ltm
Conditions:
The TurboFlex low latency profile cannot be enabled.
Impact:
The TurboFlex configuration will remain unchanged or will be the default configuration.
Recommended Action:
Customers will need to get an additional add-on license from F5 in order to enable the profile.
01071cfc : %s changing OpenSSL FIPS flag from (%d) to (%d). Reboot is required for changes to take full effect.
Location:
/var/log/ltm
Conditions:
Enabling or disabling either FIPS 140-2 compliance mode or modifying the Common Criteria DB variable (Security.CommonCriteria) changes the OpenSSL FIPS flag. Log the message. The prompt changes to 'Reboot Required'.
Impact:
The log message and the prompt change to 'Reboot Required' to remind the user to reboot for all FIPS changes to take effect.
Recommended Action:
Reboot the BIG-IP system for all processes to get initialized correctly in the compliant mode.
01071cfc : %s changing OpenSSL FIPS flag from (%d) to (%d). Reboot is required for changes to take full effect.
Location:
/var/log/ltm
Conditions:
On a BIG-IP non-VE device or hardware device that did not have a FIPS 140-2 Level 1 license, a FIPS 140-2 Level 1 license has been procured and installed.
Impact:
The system prompt changes to "REBOOT REQUIRED".
Recommended Action:
Reboot the device for the new license settings to take effect and for FIPS-specific code-paths to execute in the system OpenSSL.
01071cfd : The VLAN (%s) tag %u cannot be modified to %u once the VLAN is created. Please delete and re-create it.
Location:
/var/log/ltm
Conditions:
The configuration is invalid. The VLAN tag is not allowed to change to an existing VLAN tag when a virtual wire interface is associated with any VLANs of the same tag.
Impact:
None.
Recommended Action:
Inspect the relevant object configuration in the VLAN, trunk, and interface. You can delete the VLAN and re-create the VLAN with the tag.
01071cfe : %s (%s): AutoMitigate %s %u must be lower than AutoMitigate ceiling %u.
Location:
GUI, CLI
Conditions:
In the AFM DoS feature, the attack detection threshold is higher than the detection ceiling value set for a vector.
Impact:
An attack detection threshold that exceeds the detection ceiling value invalidates the configuration.
Recommended Action:
Reset the detection ceiling to a value higher than the threshold.
01071cff : %s (%s): AutoMitigate %s 'infinite' must be lower than AutoMitigate ceiling %u.
Location:
GUI, CLI
Conditions:
In the AFM DoS feature, the attack detection threshold value is set to Infinite while the attack detection ceiling is set to a finite value.
Impact:
The configuration is invalid.
Recommended Action:
Set the rate threshold value to a finite value that is lower than the ceiling value.
01071d00 : Maximum response size (%u) for OAuth provider (%s) must be in range of (%u-%u).
Location:
TMSH
Conditions:
When the admin specifies the maximum allowed response size for a particular provider with too large or too small of a value.
Impact:
The out of range value will not be set. The previous value remains.
Recommended Action:
The admin has to enter a value within the range.
01071d01 : Invalid value (%s) for profile %s field %s. Only integers between 0 and 4294967295 are permitted.
Location:
/var/log/ltm, console, GUI
Conditions:
When the user enters a non-integer, a negative integer, or an integer that exceeds 4294967295 in a field that's limited to unsigned long integers.
Impact:
The profile will not be updated or created until the error is corrected.
Recommended Action:
Enter a value between 0 and 4294967295 in the field indicated by the error message.
01071d02 : Size of field '%s' for monitor '%s' exceeds allowed maximum of %d bytes.
Location:
/var/log/ltm, tmsh console, iControl REST, GUI
Conditions:
When a monitor has a password, or a secret parameter, and it is being created or updated with a value exceeding the allowed maximum number of bytes.
Impact:
Upon receiving the message, a creation or modification of the object for specified monitor fails.
Recommended Action:
Set the size of the identified parameter within the specified limit.
01071d03 : Encryption object is too big.
Location:
/var/log/ltm, tmsh console, iControl REST, GUI
Conditions:
There is an object which has a parameter stored in Secure Vault, and the size of the parameter, in bytes, exceeds a documented limit during the object creation or modification.
Impact:
An operation on the object creation or modification fails.
Recommended Action:
Set the parameter's value with the documented limit.
01071d04 : Encryption failed.
Location:
/var/log/ltm, tmsh console, iControl REST, GUI
Conditions:
There is an object which has a parameter stored in Secure Vault and encryption of the parameter fails during the object creation or modification.
Impact:
An operation on the object creation or modification fails.
Recommended Action:
None.
01071d05 : %s is not a valid IP address or hostname.
Location:
/var/log/ltm, console, GUI
Conditions:
For apm::aaa::active-directory, provide invalid ip or FQDN hostname for domain-controller.
Impact:
Configuration cannot be saved.
Recommended Action:
Supply valid ip or hostname for the value.
01071d06 : Overlapping %s IP addresses (%s) is in NAT policy '%s', rule '%s'.
Location:
/var/log/ltm
Conditions:
There are overlapping IP addresses in a NAT policy rule.
Impact:
No impact. Message is informational only
Recommended Action:
None.
01071d07 : The VLANGROUP (%s) is composed of VLAN (%s) of tag %u with %s member (%s). A similar VLANGROUP must be created first and be composed of VLAN of tag '4096' with member (%s).
Location:
/var/log/ltm
Conditions:
The BIG-IP system has an invalid VLAN Group configuration.
Impact:
The BIG-IP system logs an error message.
Recommended Action:
Inspect the relevant object configuration in the VLAN Group, VLANs, and the interface used in virtual-wire configuration. Then create VLANs of tag 4096 with the same interface, and create another VLAN Group with those VLANs.
01071d08 : Connectivity profile (%s) does not exist.
Location:
/var/log/ltm
Conditions:
The connectivity profile does not exist even when a handle is on it. A race condition might have occurred.
Impact:
Upgrading or modifying a connectivity profile is likely to fail for the object in question.
Recommended Action:
To avoid race conditions, do not have multiple tmsh sessions editing the connectivity profiles.
01071d09 : Management auto-lasthop (%s) can't be disabled on a 1-NIC platform.
Location:
/var/log/ltm
Conditions:
The user tries to disable management auto-lasthop ("tmsh modify ltm global-settings general mgmt-auto-lasthop") on VE system configured with 1-NIC.
Impact:
Management auto-lasthop cannot be disabled.
Recommended Action:
None.
01071d09 : Invalid multicast address '%s' specified for multicast-ip.
Location:
/var/log/ltm
Conditions:
An invalid multicast address has been specified in the cm/device configuration. IPv4 multicast addresses must be in the 224.0.0.0/4 subnet and IPv6 multicast addresses must use the ff00:/8 prefix.
Impact:
Multicast failover packets do not work on the multicast interface, thus reducing the reliability of operation in high-availability (HA) cluster.
Recommended Action:
Configure a valid multicast address on all devices in the HA cluster.
01071d0a : adm: %s
Location:
Those messages wraps Behavioral Signature debug logs independent for development team to investigate an issue.
Conditions:
Those massages should only be activate if a further investigation of an issue is required.
Impact:
no impact
Recommended Action:
no workaround
01071d0a : Policy (%s) of type %s cannot have per-req-policy-properties attached, policy type must be %s.
Location:
cli
Conditions:
A user has tried to add a per-req-policy-properties object to an Access policy that is not of type "per-rq-policy" or "sslo-policy".
Impact:
The operation to add the per-req-properties object fails.
Recommended Action:
Add the per-req-policy-properties object to a policy of the correct type.
01071d0b : adm: %s
Location:
This log message is contained in internal Behavioral Signatures error logs.
Conditions:
Those errors could be caused by a broken feature or critical system errors.
Impact:
Behavioral signatures will not be managed correctly.
Recommended Action:
no workaround
01071d0b : Configuration error: Virtual Server (%s) with Access Profile of type sslo is not compatible with profile of type (%s).
Location:
/var/log/ltm, GUI
Conditions:
For a virtual server, an attempt has been made to assign a type of profile that is incompatible with an SSLO Access profile assigned to that virtual server. The two profiles are incompatible.
Impact:
This results in an invalid configuration.
Recommended Action:
None.
01071d0c : adm: %s
Location:
This log message wraps internal Behavioral Signatures warning logs.
Conditions:
Those errors usually refer to invalid signatures, usually self created by using the tmsh.
Impact:
The signature will not be created / modified.
Recommended Action:
Those warnings should explain what went wrong which will explain how to fix the issue.
01071d0c : Configuration error: Access Profile of type sslo is not compatible with exchange profile.
Location:
/var/log/ltm, GUI
Conditions:
An attempt has been made to add or modify both the exchange property for SSLO and an SSLO Access profile. They are incompatible.
Impact:
This results in an invalid configuration.
Recommended Action:
None.
01071d0d : adm: %s
Location:
Those messages wraps Behavioral Signature information logs.
Conditions:
Those logs indicates the successful transaction with the added / modified signature.
Impact:
no impact.
Recommended Action:
no workaround
01071d0d : Configuration error: Virtual server (%s) cannot be used for connector profile (%s), type must be internal.
Location:
/var/log/ltm, GUI
Conditions:
The user has specified a virtual server as a connector profile's entry virtual server, while the virtual server type is not set as type "nternal".
Impact:
The user cannot successfully deploy an SSL orchestrator using a connector profile.
Recommended Action:
Either remove the entry virtual server property from the connector profile, or change the virtual server's type to "internal".
01071d0e : Global ASM health alerts configurations error: %s
Location:
tmsh
Conditions:
In tmsh when trying to configure new ASM alert with illegal value.
Example:
(/Common)(tmos)# modify asm health-alerts tmm-cpu-utl-threshold 200
01071d06:3: Global ASM health alerts configurations error: tmm CPU utilization threshold can't be more than 100.
Example:
root@(eddie)(cfg-sync Disconnected)(monpd DOWN)(/Common)(tmos)# modify asm health-alerts backlog-msg-queue-utl-threshold 900
01071d06:3: Global ASM health alerts configurations error: backlog message queue utilization threshold can't be more than 100.
Impact:
The threshold for the specific ASM alert will not be configured unless a legal value is given.
Recommended Action:
Provide legal value to the threshold field.
01071d0e : Configuration error: Connector profile (%s) cannot be attached to virtual server (%s) when per-request policy (%s) is attached to this virtual server. Attach service connect agent to the per-request policy instead.
Location:
/var/log/ltm, GUI
Conditions:
The user has tried to attach a connector profile to a virtual server when a per-request policy is attached to the same virtual server.
Impact:
The user cannot successfully configure an SSL orchestrator deployment.
Recommended Action:
Either attach a connector profile to a virtual server, or attach a per-request policy to it, and attach service connect agent to the per-request policy.
01071d0f : Configuration error: Virtual server (%s) used by connector profile (%s) must have a service profile attached.
Location:
/var/log/ltm, GUI
Conditions:
The user has tried to specify an entry virtual server for a connector profile when a service profile is attaching to this virtual server.
Impact:
The user cannot configure a SSL orchestrator deployment successfully.
Recommended Action:
Either remove the service profile from the virtual server, or set the entry virtual server of the connector profile to "none".
01071d10 : Configuration error: Virtual server (%s) used by connector profile (%s) with inline service profile (%s) must have a splitsession client profile attached.
Location:
/var/log/ltm, GUI
Conditions:
The user has tried to specify an entry virtual server of a connector profile when:
1) The virtual server is attached to an inline, inline-http, or inline-http-explicit service profile, and
2) The virtual server does NOT have a split session client profile attached
Impact:
The user cannot configure the SSL orchestrator deployment successfully.
Recommended Action:
Doone of the following:
1) Set connector profile's entry virtual server to "none".
2) Change the service profile's type so that it's not any of the inline types.
3) Attach a split session client profile to the virtual server.
01071d12 : Cannot delete the Anti-Fraud URL '%s' since it is referenced by the Anti-Fraud View '%s' in the Anti-Fraud Profile '%s'.
Location:
/var/log/ltm, TMSH and GUI
Conditions:
Trying to delete a 'Base URL' while it has 'View URL' children
Impact:
Configuration failed
Recommended Action:
Delete all VIews before deleting it's parent 'Base URL'
01071d13 : Anti-Fraud Base URL '%s' must exist before creating the Anti-Fraud View '%s' in the Anti-Fraud Profile '%s'.
Location:
/var/log/ltm, TMSH and GUI
Conditions:
Trying to create a 'View URL' before its parent 'Base URL'
Impact:
Configuration load fails
Recommended Action:
Create 'Base URL' before crating its 'View URLs'
01071d14 : '%s' can be modified only for a 'Base URL', while the Anti-Fraud URL '%s#%s' is a 'View URL' in the Anti-Fraud Profile '%s'.
Location:
/var/log/ltm, TMSH and GUI
Conditions:
Trying to set a 'Base URL only' attribute in an View URL object.
Impact:
Configuration load fails
Recommended Action:
set 'Base URL only' attributes only in a Base URL objects.
01071d15 : Configuration error: access log configuration (%s) is part of system configuration, so it cannot be deleted.
Location:
/var/log/ltm, CLI, GUI
Conditions:
User attempted to delete the default APM log setting configuration.
Impact:
Deleting the default APM log setting configuration is disallowed.
Recommended Action:
None.
01071d16 : DNS profile (%s) cannot have both edns0 client subnet insertion and the DNS cache enabled simultaneously.
Location:
/var/log/ltm, GUI, CLI
Conditions:
A change was made to the configuration of a DNS profile such that both edns0 client subnet insertion and DNS caching are set to enabled.
Impact:
The current implementation of the DNS cache is not client subnet aware and therefore might cache responses for all clients when the scope of the response is actually much narrower. Consequently, the configuration changes are dropped.
Recommended Action:
Enable the DNS cache by disabling edns0 client subnet insertion (or vice versa). This can be accomplished in the same command/transaction:
tmsh modify ltm profile dns <profile_name> enable_cache <yes/no> cache <cache_name/none> edns0-client-subnet-insert <disabled/enabled>
01071d16 : Configuration error: sslo log configuration (%s) is part of system configuration, so it cannot be deleted.
Location:
/var/log/ltm, CLI, GUI
Conditions:
The user attempted to delete the default SSLO log setting configuration.
Impact:
Deleting the default SSLO log setting configuration is disallowed.
Recommended Action:
None.
01071d17 : DNS profile (%s) inherits options from DNS profile (%s) and cannot have both edns0 client subnet insertion and the DNS cache enabled simultaneously.
Location:
/var/log/ltm, GUI, CLI
Conditions:
A change was made to the configuration of the parent DNS profile so that a child DNS profile that inherits default options from the parent profile has entered an invalid state with both edns0 client subnet insertion and DSN caching enabled.
Note that the child profile might or might not be an immediate child of the parent and it is possible for the child to have one or more profiles between it and the parent profile.
Impact:
The current implementation of the DNS cache is not client subnet aware and therefore might cache responses for all clients when the scope of the response is actually much narrower. Consequently,the configuration changes are dropped.
Recommended Action:
Change the child profile so that it does not enter an invalid state. If the child profile explicitly sets a configured value rather than using the default value from the parent profile, then changing an option on the parent profile's configuration does not affect the same option on the child.
Setting the child's edns0-client-subnet-insert option to "disabled" or the cache-enabled option to "no" should allow changes to the parent profile.
01071d18 : The IP::port(%s:%d) to be dedicated, can't be shared. Refer pools(%s, %s)
Location:
/var/log/ltm
Conditions:
A pool member that is in a pool dedicated to traffic acceleration cannot also be part of another pool.
Impact:
The configuration is rejected.
Recommended Action:
Change the pool member to be in only one of the pools mentioned in the error message.
01071d19 : The IP(%s) to be dedicated, can't be shared.
Location:
/var/log/ltm
Conditions:
A member of a SNAT pool that is being used for traffic acceleration is shared between two SNAT pools.
Impact:
The configuration is rejected.
Recommended Action:
Change the configuration so that the SNAT pool member is being used in one SNAT pool only.
01071d1a : The dedicated snatpool member address (%s) matches a selfip address (%s)
Location:
/var/log/ltm
Conditions:
A SNAT pool member address matches a self IP address.
Impact:
The configuration is rejected.
Recommended Action:
Change the IP address of either the self IP or the SNAT pool member.
01071d1b : The VIP(%s) needs pool(%s) or snatpool(%s) as dedicated for Accelerated traffic only
Location:
/var/log/ltm
Conditions:
The configuration has assigned a pool or a SNAT pool to both a virtual server that is traffic accelerated and a virtual server that is not traffic accelerated.
Impact:
The configuration is rejected.
Recommended Action:
Remove the pool or SNAT pool from the non-traffic-accelerated virtual server.
01071d1b : Virtual server (%s) requires clientssl profile when the ftps-mode in FTP profile (%s) is require.
Location:
/var/log/ltm
Conditions:
A virtual server has an FTP profile, but no SSL profiles, assigned to it. Also, the FTP profile has FTPS mode set to "none" or "require".
Impact:
The virtual server creation or modification is rejected.
Recommended Action:
None.
01071d1c : The VIP(%s) in DSR mode, expect source-address-translation type(%d) as none
Location:
/var/log/ltm
Conditions:
In the configuration of the virtual server, both DSR mode and Source Address Translation are enabled.
Impact:
The configuration is rejected.
Recommended Action:
Disable either DSR mode or Source Address Translation for the virtual server.
01071d1d : The TrafficAcceleration profile(%s) does not support persist-mode(%d)
Location:
/var/log/ltm
Conditions:
A traffic acceleration profile is set to an invalid persist mode. The only persistence mode that is supported for traffic acceleration is Source Address.
Impact:
The configuration is rejected.
Recommended Action:
Assign the traffic acceleration profile to either no persistence or Source Address persistence.
01071d1e : The VIP(%s) does not support persistence profiles(%s) because it is dedicated for traffic-acceleration
Location:
/var/log/ltm
Conditions:
A persistence profile is assigned to a virtual server dedicated to traffic acceleration via Traffic Acceleration Module (TAM). TAM does not support persistence profiles.
Impact:
The configuration is rejected.
Recommended Action:
Remove either the persistence profile or the traffic-acceleration profile that is assigned to the virtual server.
01071d1f : The VIP(%s) does not support last hop pools because it is dedicated for traffic-acceleration
Location:
/var/log/ltm
Conditions:
A last hop pool is assigned to a virtual server dedicated to traffic acceleration via Traffic Acceleration Module (TAM). TAM does not support last hop pools.
Impact:
The configuration is rejected.
Recommended Action:
Remove either the last hop pool or the traffic-acceleration profile assigned to the virtual server.
01071d20 : The Pool(%s) does not support load-balancing mode(%u) because it is in use for traffic-acceleration
Location:
/var/log/ltm
Conditions:
An invalid load balancing mode is configured for a pool assigned to a Traffic Acceleration Module (TAM) virtual server. The only supported load balancing modes are Round Robin and Ratio Member.
Impact:
MCPD rejects the configuration.
Recommended Action:
Assign either the Round Robin or the Ratio Member load balancing mode to the pool assigned to the virtual server.
01071d23 : MQTT multiple peers on %s %s not supported.
Location:
/va/log/ltm
Conditions:
The MQTT protocol is attached to a Message Routing virtual server, and multiple message-routing peers are being attached to an MQTT route.
Impact:
The configuration fails. This is a validation check.
Recommended Action:
Ensure that an MQTT route does not have multiple peers, and the configuration should successfully load.
01071d24 : MQTT %s %s refers to non-existing %s %s.
Location:
/var/log/ltm
Conditions:
The MQTT protocol is attached to a Message Routing virtual server, and in an MQTT peer or route configuration, a peer or route is referencing a non-existent pool or peer.
Impact:
The configuration fails. This is a validation check.
Recommended Action:
Check whether the peer or pool being referenced by the route or peer exists. Check for any name mismatches or create the appropriate configuration objects. The configuration should successfully load.
01071d25 : \'%s\' at rule %s is %s by virtual server %s of type %s.
Location:
GUI, CLI
Conditions:
The virtual server is configured not as flow-based. For example, the command "virtual" does not work when the virtual server is message-routing.
Impact:
Some iRule commands cannot run, and the error prevents the configuration from loading.
Recommended Action:
Fix the tcl script by deleting the offending command.
01071d25 : Error configuring Virtual Server (%s). Connection mirroring is not supported in combination with an IMAP profile.
Location:
/var/log/ltm, CLI, GUI
Conditions:
Connection mirroring is configured with an IMAP profile.
Impact:
This is an invalid configuration.
Recommended Action:
Do not use connection mirroring in IMAP profiles.
01071d26 : Error configuring Virtual Server (%s). Connection mirroring is not supported in combination with an POP3 profile.
Location:
/var/log/ltm, CLI, GUI
Conditions:
An attempt was made to configure connection mirroring with an IMAP profile.
Impact:
The configuration fails.
Recommended Action:
Do not use connection mirroring on POP3 profiles.
01071d27 : Error parsing SAML assertion consumer service url: (%s) in SAML SP connector (%s)
Location:
/var/log/ltm, VPE UI, CLI
Conditions:
In an Access Policy Manager (APM) Single Sign-On (SSO) saml-sp-connector object, one of the specified assertion consuming services contains an improperly structured URL.
Impact:
The object containing this configuration is not saved. This is an MCP configuration error.
Recommended Action:
Verify that the provided URL is correct. If the URL is not correct, specify the correct URL in the assertion consuming services of the APM SSO saml-sp-connector object.
01071d28 : 'sp-location' in SAML SP connector (%s) is set to internal-multi-domain, but the virtual server where SP is located is not specified in 'multi-domain-location' property.
Location:
/var/log/ltm, VPE UI, CLI
Conditions:
For an Access Policy Manager (APM) Single Sign-On (SSO) saml-sp-connector object, an administrator has set the "sp-location" property to "internal-multi-domain", even though the "multi-domain-location" property is not specified.
Impact:
The object containing this configuration is not saved. This is an MCP configuration error.
Recommended Action:
In the object's "multi-domain-location" property, specify the URL for the virtual server location behind which the SAML service provider is located. The location must contain the scheme and hostname only, for example, https://application.f5.com.
01071d28 : Virtual server (%s) requires clientssl profile (%s) to enable SSL forward proxy when FTP profile (%s) is present.
Location:
/var/log/ltm
Conditions:
A virtual server is configured as follows:
1) An FTP profile and SSL profiles assigned to it, and
2) The FTPS mode in the FTP profile is set to "none" or "require", and
3) The SSL profiles have forward proxy disabled.
Impact:
The virtual server creation or modification is rejected.
Recommended Action:
None.
01071d29 : Multidomain location (%s) of SAML SP connector (%s) is invalid: (%s). Location must begin with http or https and must contain hostname with no path.
Location:
/var/log/ltm, VPE UI, CLI
Conditions:
In an Access Policy Manager (APM) Single Sign-On (SSO) saml-sp-connector object, the configured property "multi-domain-location" is not in the expected format.
For example, the location URI must not contain a path part or query parameters.
Impact:
The object containing this configuration is not saved. This is an MCP configuration error.
Recommended Action:
For the object's "multi-domain-location" property, specify the URL for the virtual server location behind which the SAML service provider is located. The location must contain the "http" or "https" scheme and the hostname, for example, https://application.f5.com.
01071d29 : Virtual server (%s) requires clientssl profile (%s) to enable SSL verified handshake when FTP profile (%s) is present.
Location:
/var/log/ltm.
Conditions:
A virtual server is configured with an FTP profile and SSL profiles, and the SSL profiles have forward proxy enabled.
Impact:
The virtual server creation or modification is rejected.
Recommended Action:
None.
01071d2a : Cipher rule (%s): '%s' is not a valid %s.
Location:
/var/log/ltm
Conditions:
When creating a cipher rule, either an invalid DH Group or an invalid Signature Algorithm was specified. The error will contain which had an issue, and the exact issue.
Impact:
The cipher rule will not be created or modified.
Recommended Action:
Only use correct DH Groups and correct Signature Algorithms.
01071d2a : When OpenID Connect is enabled for OAuth profile (%s) and the alg type for %s primary key (%s) is 'HS512', the client secret for all associated Client apps with OpenID Connect enabled should be of size 64 bytes. Please re-generate the client secret for Client app (%s).
Location:
/var/log/ltm, TMSH
Conditions:
There is an OAuth Profile configuration or an OAuth Client App configuration that has:
1) "Support OpenId Connect" enabled, and
2) An ID token primary key and/or UserInfo primary key that is set as HS512, and
The size of the client secret for associated client apps is not 64 bytes in length.
Impact:
Saving the configuration fails.
Recommended Action:
Regenerate the client secret so that it is 64 bytes in length, and then save.
01071d2b : ID token lifetime (%u) for %s (%s) must be in range of (%u-%u).
Location:
/var/log/apm, GUI, CLI
Conditions:
The administrator has set an ID token lifetime out of its valid range. Both the OAuth profile and the Client App configuration have an ID token lifetime setting.
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
Set a valid ID token lifetime in OAuth Profile and OAuth Client App.
01071d2b : Virtual server (%s) cannot have connector profiles when allow-active-mode in FTP profile (%s) is enabled.
Location:
/var/log/ltm
Conditions:
A virtual server is configured with both an FTP profile and a connector profile, and the FTP profile with the allow_active_mode option is enabled.
Impact:
The virtual server creation or modification is rejected.
Recommended Action:
None.
01071d2c : When OpenID Connect is enabled, a JWK config must be assigned as the ID Token Primary Key for OAuth Profile (%s).
Location:
/var/log/apm, GUI, CLI
Conditions:
In OAuth profile, the ID token primary key is not selected when OpenID Connect is enabled.
Impact:
The BIG-IP system logs and displays an error message.
Recommended Action:
In the OAuth profile, set the ID token primary key when OpenID Connect is enabled.
01071d2d : When OpenID Connect is enabled, support for JWT token should be enabled for OAuth profile(%s).
Location:
/var/log/apm, GUI, CLI
Conditions:
In OAuth Profile, JWT token support is not enabled when OpenID Connect support is enabled.
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
In the OAuth Profile, enable JWT token support when OpenID Connect support is enabled.
01071d2f : The OAuth profile (%s) does not allow JWK config (%s) with duplicate key-id (%s) of type (%s) within UserInfo Primary Key and Rotation Keys.
Location:
/var/log/apm, GUI, CLI
Conditions:
In an OAuth profile, UserInfo Primary Key and Rotation Keys are set to JWK config with duplicate key-id and key type.
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
In the OAuth profile, do not set UserInfo Primary Key and Rotation Keys to JWK config with duplicate key-id and key type.
01071d30 : OAuth claim (%s) has invalid value (%s). For '%s' claim, allowed value is a numeric value or a valid session variable.
Location:
The save operation on an object or a configuration load operation fails.
Conditions:
Some OAuth claim (for example: updated_at) has an invalid value (that is, not a valid number or a session variable).
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
Configure a specific OAuth claim (such as: updated_at) to have a valid value (that is, a valid number or a session variable).
01071d31 : Authentication type for Client app (%s) is not valid. When OpenID Connect is enabled for OAuth profile (%s) and the key type for %s primary key (%s) is 'octet', then all associated Client apps with OpenID Connect enabled should have the authentication type as 'Secret'.
Location:
/var/log/ltm, CLI
Conditions:
There is an OAuth Profile configuration or an OAuth Client App configuration that has:
1) "Support OpenId Connect" enabled, and
2) An ID token primary key and/or UserInfo primary key that is of type "Octet", and
The authentication type for the Client app is not "Secret".
Impact:
Saving the configuration fails.
Recommended Action:
Change the authentication type of the Client app to "Secret" and save the object.
01071d32 : The OAuth profile (%s) does not allow JWK config with duplicate key-id (%s) of type (%s) within %sPrimary Key (%s) and %sPrimary Key (%s).
Location:
/var/log/apm, GUI, CLI
Conditions:
In an OAuth profile, JWK with duplicate kid and key type are selected among JWT Access Token primary key, ID token primary key, or UserInfo primary key.
Impact:
The save operation on an object or a configuration load operation fails.
Recommended Action:
In OAuth profile, do not set the JWT Access Token primary key, ID token primary key, and/or UserInfo primary key to JWK config with duplicate key-id and key type.
01071d33 : JWK config (%s) cannot be configured to use both client secret and shared secret for key type octet.
Location:
/var/log/ltm, CLI
Conditions:
A JWT key configuration is created with type "octet", and the key is configured to use both a client secret and a shared secret.
Impact:
The object is not saved.
Recommended Action:
Ensure that the JWT key configuration with type "octet" is configured to use either a client secret or a shared secret, but not both.
01071d34 : In JWT config (%s), the %s JWK config (%s) cannot be configured to use client secret when key type is octet.
Location:
/var/log/ltm, GUI, CLI
Conditions:
A JWT key that is configured to use a client secret for type "octet" is associated as a blocked or allowed key in a JWT token configuration.
Impact:
The object is not saved.
Recommended Action:
Ensure that a JWT key configuration with type "octet" and a shared secret is associated with JWT token configuration as an allowed or blocked key.
01071d36 : JWK config (%s) is %sconfigured to use client secret for key type octet. Hence, this cannot be used as %s primary key in %s (%s).
Location:
/var/log/ltm, GUI, CLI
Conditions:
This appears in either of the following scenarios:
1) A JWT key configuration of type 'octet' is configured to use a client secret and it is assigned as a JWT primary key in the OAuth profile.
2) A JWT key configuration of type 'octet' is configured to use a shared secret and it is assigned as an ID Token primary key in the OAuth profile.
Impact:
The object is not saved.
Recommended Action:
If the JWT key is configured as a JWT primary key in the OAuth profile, do not configure the key to use a client secret.
If the JWT key is configured as an ID token primary key in the OAuth profile, configure the key to use a client secret.
01071d36 : The prefix (%s) is a reserved word and claim name (%s) cannot be used for the claim (%s). Please remove or change the prefix to continue.
Location:
GUI, CLI
Conditions:
An administrator is trying to configure a claim name that has a reserved prefix.
Impact:
The BIG-IP system rejects the new claim configuration.
Recommended Action:
Change or remove the reserved prefix of the claim name.
01071d37 : %s claim (%s) cannot be associated with %s (%s) since the claim name is 'address'. Please create and associate claims with claim name (street_address, locality, region, postal_code, country) that are sub-fields of this claim.
Location:
/var/log/ltm, GUI, CLI
Conditions:
An OAuth claim with a claim name address is associated as an ID Token claim or UserInfo claim in the OAuth profile or Client App configuration.
Impact:
The object is not saved.
Recommended Action:
Do not associate an OAuth claim with claim name "address" as an ID Token or UserInfo claim in an OAuth Profile or Client app configuration. Instead, create and associate claims with claim name (street_address, locality, region, postal_code, country) that are sub-fields of this claim "address".
01071d38 : %s claim (%s) cannot be associated with OAuth Authorization agent (%s), entry (%d) since the claim name is 'address'. Please create and associate claims with claim name (street_address, locality, region, postal_code, country) that are sub-fields of this claim.
Location:
/var/log/ltm, GUI, CLI
Conditions:
An OAuth claim with claim name "address" is associated as an ID Token claims or UserInfo claim in the OAuth Authorization agent.
Impact:
The object is not saved.
Recommended Action:
Do not associate an OAuth claim with claim name "address" as an ID Token or UserInfo claim in an OAuth Authroization agent. Instead, create and associate claims with claim name (street_address, locality, region, postal_code, country) that are sub-fields of this claim "address".
01071d39 : The claim name of the Claim (%s) cannot be changed to 'address' because this claim is part of %s claims that is associated with %s (%s). Please create and associate claims with claim name (street_address, locality, region, postal_code, country) that are sub-fields of this claim.
Location:
/var/log/ltm, GUI, CLI
Conditions:
An administrator has changed the name of the claim to "address", and the claim is associated as an ID Token or UserInfo claim in the OAuth profile or client app.
Impact:
The object is not saved.
Recommended Action:
Do not change name of the claim to "address" if the claim is associated as an ID Token or UserInfo claim in the OAuth profile or client app. Instead, create and associate claims with claim name (street_address, locality, region, postal_code, country) that are sub-fields of this claim.
01071d3a : The claim name of the Claim (%s) cannot be changed to 'address' because this claim is part of %s claims that is associated with OAuth Authorization agent (%s), entry (%d). Please create and associate claims with claim name (street_address, locality, region, postal_code, country) that are sub-fields of this claim.
Location:
/var/log/ltm, GUI, CLI
Conditions:
An administrator has changed the name of the claim to "address", and the claim is associated as an ID Token or UserInfo claim in the OAuth Authorization agent.
Impact:
The object is not saved.
Recommended Action:
Do not change name of the claim to "address" if the claim is associated as an ID Token or UserInfo claim in the OAuth Authorization agent. Instead, create and associate claims with claim name (street_address, locality, region, postal_code, country) that are sub-fields of this claim.
01071d3b : %s claim (%s) cannot be associated with %s (%s). The claim value must be set to 'true', 'false' or a valid session variable.
Location:
GUI, CLI
Conditions:
The “email_verified” and “phone_number_verified” claims are not set to “true”, “false”, or a valid session variable, and these claims are associated with an OAuth profile’s or client app’s “ID Token” or “UserInfo” claim.
Impact:
Saving a claim object fails.
Recommended Action:
Change the claim values to a recommended value, that is, "true", "false", or a valid session variable.
01071d3c : %s claim (%s) cannot be associated with OAuth Authorization agent (%s), entry (%d). The claim value must be set to 'true', 'false' or a valid session variable.
Location:
GUI, CLI
Conditions:
The "email_verified" and "phone_number_verified" claims are not set to "true", "false", or a valid session variable, and the claims are associated with OpenID-relaed claims on the OAuth Authorization agent.
Impact:
Saving a claim object fails.
Recommended Action:
Either set each claim value to a recommended value, or do not associate the claims with the OAuth Authorization agent.
01071d3d : The claim value must be set to 'true', 'false' or a valid session variable for Claim (%s) when it is attached to %s claims on %s (%s).
Location:
GUI, CLI
Conditions:
The "phone_number_verified" or "email_verified" claim is not set to "true", "false", or a valid session variable, and the claim is attached to an OAuth profile's or client app's OpenID-related claim.
Impact:
The claim object is not saved.
Recommended Action:
Set the claim values to a recommended value, that is, "true", "false", or a valid session variable.
01071d3e : The claim value must be set to 'true', 'false' or a valid session variable for Claim (%s) when it is attached to %s claims on OAuth Authorization agent (%s), entry (%d).
Location:
GUI, CLI
Conditions:
When modified, the 'phone_number_verified' or 'email_verified' claim is not set to "true", "false", or a valid session variable, and the claim is attached to an OAuth profile's or client app's OpenID-related claim.
Impact:
The claim object is not saved.
Recommended Action:
Set each claim to a recommended value, that is, "true", "false", or a valid session variable.
01071d3f : Can't find prime AVR-profile.
Location:
/var/log/audit, /var/log/ltm, GUI, CLI
Conditions:
An expected AVR base/prime profile does not exist on the system.
Impact:
This message is a sanity check to ensure that the base/prime profile for AVR was created successfully. AVR functionality might not work as expected. Also, AVR profile creation and modification might not be possible.
Recommended Action:
None.
01071d40 : Can't generate more than %d %s when collecting AVR statistics.
Location:
tmsh
Conditions:
The error appears when the user tries to add more than the maximum limit of IP addresses, URLs, countries or subnet IP addresses to the predefined lists. The current maximum limit per list is 10.
For example:
1) modify ltm profile analytics analytics ips-for-stat-collection add {172.29.54.1 172.29.54.2 172.29.54.3 172.29.54.4 172.29.54.5 172.29.54.6 172.29.54.7 172.29.54.8 172.29.54.9 172.29.54.10 172.29.54.11 172.29.54.12}
2) modify ltm profile analytics analytics urls-for-stat-collection add {/url1 /url2 /url3 /url4 /url5 /url6 /url7 /url8 /url9 /url10 /url11}
Impact:
N/A
Recommended Action:
Verify that the number of items per list after running the command will not exceed the maximum limit.
01071d41 : Can't generate a list of %s because 'collect_%s' flag is disabled.
Location:
tmsh
Conditions:
The error appears when:
1. Running the following TMSH command when the 'collect_ip' flag is disabled:
modify ltm profile analytics analytics ips-for-stat-collection add { <ip address>}
2. Running the following TMSH command when the 'collect-geo' flag is disabled:
modify ltm profile analytics analytics countries-for-stat-collection add {<countries>}
3. Running the following TMSH command when the 'collect-subnets' flag is disabled:
modify ltm profile analytics analytics subnets-for-stat-collection add {<subnet ips>}
4. Running the following TMSH command when the 'collect-url' flag is disabled:
modify ltm profile analytics analytics urlss-for-stat-collection add {<urls>}
Impact:
Recommended Action:
Enable the specific flag and rerun the command.
01071d41 : Anti-Fraud View '%s' is invalid. View must be non-empty string with size less than %u and should contain only valid characters in the Anti-Fraud Profile '%s'.
Location:
tmsh console, /var/log/ltm
Conditions:
trying to configure an empty view ID (A.K.A view name)
Impact:
configuration failure
Recommended Action:
while configuring views, use a non-empty name
01071d42 : Can't generate list of counties because the '%s' is invalid.
Location:
CLI
Conditions:
The following TMSH command has been run with an invalid country name:
modify ltm profile analytics analytics countries-for-stat-collection add {"country name"}
Impact:
The operation to generate a list of countries fails.
Recommended Action:
Run the TMSH command with a valid country name. If the country name has multiple words, write the name in the following format: "<country name>". Use TAB to see the list of valid countries.
01071d43 : Can't generate list of urls because the '%s' URL's length is exceeded maximum %1d.
Location:
TMSH
Conditions:
The error appears when running the following TMSH command with a URL that exceeded the maximum allowed length of 255 characters:
list ltm profile analytics analytics urls-for-stat-collection add {<url>}
Impact:
Recommended Action:
Run the command with a URL that does not exceed the maximum allowed length.
01071d44 : The Traffic Matching Criteria (%s) is already in use by another Netflow Protected Server (%s).
Location:
/var/log/ltm
Conditions:
Validation error. Each Netflow Protected Server object must reference a unique Traffic Matching Criteria. A Traffic Matching Criteria cannot service more than one Netflow Protected Server.
Impact:
Validation error might lead to configuration load, upgrade, and sync failures.
Recommended Action:
Remove one of the references to Traffic Matching Criteria before assigning it to the intended Netflow Protected Server.
01071d44 : Invalid type %s for %s %s. All the %s should be the same type (IPv4 ot IPv6).
Location:
CLI
Conditions:
The user has run the following TMSH commands to add IP addresses or subnet IP addresses to the predefined list, where one or more of the IP addresses are not the same IP address version:
1. modify ltm profile analytics analytics ips-for-stat-collection add {<ip address>}
2. modify ltm profile analytics analytics subnets-for-stat-collection add {<subnet ip>}
Impact:
An error message appears.
Recommended Action:
Verify that the IP addresses/subnet IP addresses in the predefined lists are the same version.
01071d45 : Invalid Netflow Protected Server [%s] name for stopping redirection
Location:
/var/log/ltm
Conditions:
When trying to stop redirection on a non-existent Netflow Protected Server.
Impact:
Validation error.
Recommended Action:
Reference an existant Netflow Protected Server.
01071d45 : Discovery interval (%u) for OAuth provider (%s) must be greater than (%u) minutes.
Location:
/var/log/ltm
Conditions:
An attempt is made to set the discovery interval to a value that is less than 60.
Impact:
The discovery interval remains unchanged.
Recommended Action:
Change the discovery interval to a value that is greater than 60.
01071d46 : Netflow Protected Server (%s) cannot have a Traffic Matching Criteria that references a route domain.
Location:
/var/log/ltm, CLI
Conditions:
The system cannot validate the system configuration.
Impact:
The configuration fails.
Recommended Action:
In the traffic matching criteria for a Netflow Protected Server, do not reference a route domain.
01071d47 : (%s) has an invalid mask %u.
Location:
/var/log/ltm
Conditions:
Configuration validation, when an IP Address is configured with invalid mask. For example, 10.10.0.1/24 should be 10.10.0.1/32.
Impact:
Configuration exception.
Recommended Action:
Provide the correct mask.
01071d49 : Specified compatibility level-%d is too high. That level includes feature settings that are not supported for this platform.
Location:
/var/log/ltm
Conditions:
The user has set the compatibility level to one that is not allowed on the current platform.
Impact:
None.
Recommended Action:
Enter a supported compatibility level for the platform.
01071d4a : Security FlowSpec: %s: router-id(%s) is not a valid IPv4 address.
Location:
/var/log/ltm, GUI, CLI
Conditions:
The security flowspec-route-injector profile or its neighbor is configured incorrectly.
Impact:
The related configuration will not be in the system.
Recommended Action:
None.
01071d4b : Security FlowSpec: %s: %s (%s) has mis-matched route domain (%d).
Location:
/var/log/ltm, GUI, CLI
Conditions:
The security flowspec-route-injector profile or its neighbor is configured incorrectly.
Impact:
The related configuration will not be in the system.
Recommended Action:
None.
01071d4c : Route domain (%s) can not have both 'Security Flowspec BGP' and 'Zebos BGP' routing planes enabled at the same time.
Location:
/var/log/ltm, GUI, CLI
Conditions:
The configuration referenced in the error message prevents a configuration object from being updated.
Impact:
The relevant configuration is not updated.
Recommended Action:
Revise the configuration.
01071d4d : Security FlowSpec: %s: missing required field(s) %s.
Location:
/var/log/ltm, GUI, CLI
Conditions:
The configuration described in the error message is invalid.
Impact:
The relevant configuration will not be updated.
Recommended Action:
Change the required field or fields.
01071d4e : Security FlowSpec: %s: must have at least one 'neighbor' specified.
Location:
/var/log/ltm, GUI, CLI
Conditions:
The configuration described in the error message is invalid.
Impact:
The relevant configuration will not be updated.
Recommended Action:
Specify at least one neighbor.
01071d4f : Security FlowSpec: %s: The datatype (%d) for inherited fields is missing.
Location:
/var/log/ltm, GUI, CLI
Conditions:
The configuration described in the error message is invalid.
Impact:
The relevant configuration will not be updated.
Recommended Action:
Specify the data type referenced in the error message.
01071d50 : Security FlowSpec: %s: %s is non-mutable field.
Location:
/var/log/ltm, GUI, CLI
Conditions:
The configuration described in the error message is invalid.
Impact:
The relevant configuration will not be updated.
Recommended Action:
Fix the invalid configuration referenced in the error message.
01071d51 : Security FlowSpec: %s: %s doesn't have matched address family.
Location:
/var/log/ltm, GUI, CLI
Conditions:
The configuration described in the error message is invalid.
Impact:
The relevant configuration will not be updated.
Recommended Action:
Fix the invalid configuration referenced in the error message.
01071d52 : The attribute (%s) for (%s) cannot be none.
Location:
/var/log/ltm, GUI, CLI
Conditions:
A value is set to "none".
Impact:
The validation fails.
Recommended Action:
Change configuration to a valid non-zero value, or set using default keyword.
01071d54 : The value (%lld) for attribute (%s) for (%s) must be within range %s.
Location:
/var/log/ltm, CLI
Conditions:
A configured value is invalid because it is out of the allowed range.
Impact:
The configuration fails to load.
Recommended Action:
Set the value within the range specified in the error message.
01071d55 : Security FlowSpec: %s: can not refer route domain (%s) which is neither in the same partition as profile nor in /Common partition.
Location:
/var/log/ltm, GUI, CLI
Conditions:
The route domain is not in the same administrative partition as the profile or in partition /Common.
Impact:
The relevant configuration will not be updated.
Recommended Action:
Fix the configuration so that the route domain is in the correct administrative partition.
01071d56 : Limit on the number of extended white list entries (%u) has been reached. Please modify the value of dos.maxewlsize to allow more entries.
Location:
/var/log/ltm
Conditions:
The number of extended white list entries that can be configured on Neuron platforms exceeds the value set in the db variable dos.maxewlsize.
Impact:
The configuration is rejected. Applies to Neuron platform, DOS extended white list.
Recommended Action:
Change the value of dos.maxewlsize (max value 1024) to allow more extended white list entries.
01071d57 : The %s (%s) attribute %s can only reference objects in partition %s.
Location:
/var/log/ltm, CLI
Conditions:
The user is attempting to configure an attribute that references an object in an illegal administrative partition.
Impact:
The validation fails.
Recommended Action:
Reference objects that reside in legal partitions or partition Common.
01071d59 : Cannot modify scrubber config property %s
Location:
GUI, CLI
Conditions:
An attempt was made to modify fields that are part of the key in the scrubber configuration objects.
Impact:
You cannot perform the modify operation.
Recommended Action:
None.
01071d5a : IPv4/IPv6 Next hop must be configured.
Location:
GUI, CLI
Conditions:
While creating RTBH blacklist publisher profile, the user has not provided either of the next-hop v4 or next-hop-v6 addresses for the profile, and the advertisement method for the profile is BGP.
Impact:
The configuration fails.
Recommended Action:
Provide either of the v4 or v6 next hop IP addresses.
01071d5b : Not a valid %s Address.
Location:
GUI, CLI
Conditions:
The user configures an invalid IP address to the route-advertisement-nexthop or route-advertisement-nexthop-v6 attributes in the Blacklist publisher profile.
Impact:
The configuration fails.
Recommended Action:
Fix the configuration value for the next hop or nexthop-v6 IP addresses.
01071d5c : Cannot lower compatibility level. Whitelist address-list (%s) configured on this system requires current compatibility level.
Location:
/var/log/ltm, GUI, CLI
Conditions:
The system already has a configuration that depends on the currently-configured compatibility system level.
Impact:
The user can't lower the value of the compatibility level with an existing whitelist address list.
Recommended Action:
Remove the whitelist before the compatibility level can be lowered on a supported platform.
01071d5f : Entry already exist in extened white list(%s).
Location:
GUI, CLI
Conditions:
A user has tried to add a duplicate entry.
Impact:
The system performs validation to prevent duplicate entries.
Recommended Action:
Correct the configuration to prevent attempts to add duplicate entries.
01071d60 : %s failed with an I/O error: %s.
Location:
/var/log/ltm
Conditions:
An attempt is made to configure a WOM local-endpoint from tmsh or the GUI.
Impact:
mcpd logs the error and rolls back the transaction. The configuration associated with the transaction is not applied, and mcpd is left in the state it was in prior to the transaction. The WOM local-endpoint is not configured.
Recommended Action:
Try again. If that fails, save the current configuration and restart mcpd.
01071d61 : Failed to allocate memory at %s:%d.
Location:
/var/log/ltm
Conditions:
The mcpd daemon is out of memory, causing a memory allocation of unknown size to fail. This can occur during an attempt to process a very large transaction.
Impact:
A hard exit from mcpd will probably occur.
Recommended Action:
Consider provisioning mcpd with more memory. This will cause the TMM to have less memory for itself, but mcpd will be able to process larger and more complex configurations.
01071d62 : CMI device (%s) attempted to connect but is running an incompatibly old version of TMOS.
Location:
/var/log/ltm
Conditions:
The remote device is running an older software version that did not indicate a required DSC handshake protocol version in the message.
Impact:
Config sync is disabled between this device and another trust domain member. Config sync will remain disabled until the other device is upgraded to a compatible version.
Recommended Action:
Upgrade the other device to a compatible version and reboot the other device into the new installation volume.
01071d62 : Unsupported route-type (%d) seen for mgmt-route (%s).
Location:
/var/log/ltm
Conditions:
Management-route is an unsupported route type.
Impact:
There is a possible management-route misconfiguration.
Recommended Action:
Verify that management-route is of type Gateway, Interface, or Blackhole only.
01071d63 : CMI device (%s) attempted to connect but is running a version of TMOS with incompatible version (%s) (expected %s).
Location:
/var/log/ltm
Conditions:
The remote device is running an older software version that did not indicate a required DSC handshake protocol version in the message.
Impact:
Config sync is disabled between this device and another trust domain member. Config sync will remain disabled until the other device is upgraded to a compatible version.
Recommended Action:
Upgrade the other device to a compatible version.
01071d63 : No value specified for supersede-option: %s
Location:
/var/log/ltm
Conditions:
No value is specified to supersede the DHCP server-provided value for the tmsh supersede-option setting.
Impact:
Configuration of the supersede-option in "tmsh sys management-dhcp" fails.
Recommended Action:
Ensure that every supersede-option in "tmsh sys management-dhcp" has at least one value specified to supersede the DHCP server-provided value for the given option.
01071d65 : DNSSEC External Zone (%s) must be a descendant of DNSSEC Zone (%s).
Location:
/var/log/gtm
Conditions:
The external zone is not a descendant of the parent zone. (e.g. external zone: child.f5.com, parent: notf5.com). The parent name must be a suffix of the child name.
Impact:
The external zone must be a descendant of the parent zone in order to establish the DNSSEC chain of trust. If the parent zone name is not a suffix of the child zone name (child not descendant of parent), a chain of trust cannot be established.
Recommended Action:
Verify zone name of external zone to ensure it is a descendant of the parent zone.
01071d65 : Invalid name value (%s) specified for URL Category %s.
Location:
/var/log/ltm
Conditions:
The user is trying to create a new URL category, and the category name has an invalid start character (that is, any character within "*/-:_?=@,&()0123456789", including a character such as ".*/-:_?=@,&() ".
Impact:
The configuration is not saved and the user will be unable to create a new custom category.
Recommended Action:
Remove the invalid or special characters in the category name and then rename the category that contains the valid characters.
01071d66 : DNSSEC External Zone (%s:%s) duplicates existing DNSSEC zone (%s) with the same name (case-insensitive and unique across folders).
Location:
/var/log/gtm
Conditions:
This occurs when attempting to create an External Zone, while a DNSSEC Zone sharing the same name already exists.
Impact:
Creation of a duplicate DNSSEC Zone will fail.
Recommended Action:
Modify the existing DNSSEC Zone under the specified name, otherwise delete it before creating the External Zone. Be sure to verify if the zone you want to be created is internal or external.
01071d66 : System iRule (%s) cannot be associated to oauth server (%s).
Location:
/var/log/ltm
Conditions:
A system iRule is associated with an OAuth server.
Impact:
The configuration is invalid. System iRules are specific iRules created to solve certain use cases, which do not include association with an OAuth server.
Recommended Action:
Do not associate system iRules with an OAuth server.
01071d67 : DNSSEC External Zone (%s:%s) duplicates existing external zone (%s:%s) with the same name (case-insensitive).
Location:
/var/log/gtm
Conditions:
This occurs when attempting to create an External Zone, while an External Zone sharing the same name already exists.
Impact:
Creation of a duplicate External Zone will fail.
Recommended Action:
Modify the existing External Zone under the specified name, otherwise delete it before creating the zone again.
01071d67 : Provider type F5 only supports introspect endpoint.
Location:
/var/log/ltm, GUI, or CL, depending on where the command is for setting introspect-support to false on a provider object of type "F5".
Conditions:
introspect-support is set to "false" on provider object of type "F5".
Impact:
A provider object of type "F5" fails to create/modify when introspect-support is set to "false".
Recommended Action:
For a provider object of "F5", always set introspect-support to "true".
01071d68 : DNSSEC External Zone (%s) references a nonexistent DNSSEC zone (%s)
Location:
/var/log/gtm
Conditions:
This occurs when an External Zone being created references a non-existant parent zone.
Impact:
Creation of External Zone will fail. It must have a valid parent zone to maintain DNSSEC chain
of trust.
Recommended Action:
Verify name of External Zone and make sure it references an existing parent zone.
01071d68 : EntityID attribute of %s (%s) contains a session variable. SAML metadata exported by this object must be edited manually to replace session variables with valid hostnames before metadata is shared with external parties.
Location:
/var/log/ltm, VPE UI, CLI
Conditions:
For an Access Policy Manager (APM) Single Sign-On (SSO) saml object, the BIG-IP system has taken the role of SAML Identity Provider and the "entityID" property contains a session variable instead of a valid host name.
Impact:
SAML metadata cannot be shared with external parties.
Recommended Action:
Do one of the following:
- Do not use session variables when configuring the entityID property of an APM SSO saml object, or
- When exporting SAML IdP metadata produced by the configured APM SSO saml object, modify the metadata manually to replace all instances of session variables with the host name of configured IdP.
01071d69 : DNSSEC Zone %s duplicates existing external zone (%s:%s) with the same name (case-insensitive).
Location:
/var/log/gtm
Conditions:
This occurs when attempting to create a DNSSEC Zone, while an External Zone sharing the same name already exists.
Impact:
Creation of a duplicate External Zone will fail.
Recommended Action:
Modify the existing External Zone under the specified name, otherwise delete it before creating the DNSSEC zone. Be sure to verify if the zone you want to be created is internal or external.
01071d69 : Frequency for SAML IdP automation (%s) cannot be zero.
Location:
/var/log/ltm, CLI
Conditions:
An attempt was made to save a configuration with SAML IdP automation having a value of zero for the field "Frequency".
Impact:
Saving the configuration fails.
Recommended Action:
Enter a non-zero value in the "Frequency" field.
01071d6a : Unable to parse DNSSEC secure delegation record (%s:%s):%s (%s).
Location:
/var/log/gtm
Conditions:
This occurs when attempting to create an External Zone with an invalid DS Record, leading to parse failures.
Impact:
Creation of a External Zone will fail.
Recommended Action:
Verify the DS Record is has the correct format, it should follow this structure:
"zone_name ttl type class tag alg digest_type digest"
e.g:
"myzone. 86400 IN DS 46851 7 1 4a7d19625ebc07e6aad53aad043e15d578e605e8"
01071d6a : At least one metadata URL must be configured for SAML SP metadata automation (%s).
Location:
/var/log/apm or GUI
Conditions:
An administrator attempts to configure SAML SP automation service, but the automation object does not specify any URLs from where SAML metadata is to be fetched.
Impact:
The misconfigured SAML SP automation object is not saved.
Recommended Action:
Specify at least one URL from where automation service will retrieve SAML metadata.
01071d6a : Client SSL profile (%s): Configured certificates are incompatible with TLS 1.3.
Location:
/var/log/ltm
Conditions:
A Client SSL profile is created that can only negotiate TLS 1.3, even though all of its associated certificates are on a FIPS or NetHSM device.
Impact:
The profile cannot be saved.
Recommended Action:
Configure the profile to negotiate TLS versions other than 1.3 or have at least one certificate that is not on a FIPS or NetHSM device.
01071d6b : DNSSEC secure delegation record (%s:%s) has DS with different owner name: %s.
Location:
/var/log/gtm
Conditions:
This occurs when attempting to create an External Zone, while the DS record owner does not match the zone name.
Impact:
Creation of a duplicate External Zone will fail.
Recommended Action:
Verify that the DS Record owner matches the zone name.
01071d6b : Frequency for SAML SP metadata automation (%s) cannot be zero.
Location:
/var/log/apm or GUI
Conditions:
An administrator has attempted to configure SAML SP automation service, but the specified frequency of metadata fetching is invalid ("0").
Impact:
The misconfigured SAML SP automation object is not saved.
Recommended Action:
Specify a valid frequency in minutes, or keep the default value, 60.
01071d6b : Client SSL profile (%s): Configured certificates are incompatible with TLS 1.3, so TLS 1.3 will not be negotiated.
Location:
/var/log/tmm
Conditions:
A Client SSL profile is created with TLS 1.3 enabled, even though all certificates are stored on a FIPS or NetHSM device that is incompatible with TLS 1.3.
Impact:
TLS 1.3 is not negotiated.
Recommended Action:
Either disable TLS 1.3 on the profile, or include at least one certificate that is not stored on a FIPS or NetHSM device.
01071d6c : SAML SP metadata automation (%s) cannot be associated with sso saml (%s) because sso saml is already associated with SP automation (%s). SAML server can only be associated with one automation.
Location:
/var/log/apm or GUI
Conditions:
An administrator has attempted to configure a SAML SP automation service, but the specified SSO SAML object is already used by another SP automation service.
Impact:
The misconfigured SAML SP automation object is not saved.
Recommended Action:
Specify a different SSO SAML object that is not in use by other SP automation services.
01071d6c : Client SSL profile (%s): Some configured certificates are incompatible with TLS 1.3, so will not be used if TLS 1.3 is negotiated.
Location:
/var/log/ltm
Conditions:
A Client SSL profile is configured to enable TLS 1.3, even though some of the certificates are stored on a FIPS or NetHSM device.
Impact:
The certificates stored on the FIPS or NetHSM device are not used if TLS 1.3 negotiation is attempted.
Recommended Action:
Disable TLS 1.3 on the Client SSL profile, or remove the certificates that are stored on a FIPS or NetHSM device.
01071d6d : SAML SP metadata automation (%s) specifies SAML SSO server (%s) that cannot be found on the system.
Location:
/var/log/apm or GUI
Conditions:
An administrator has attempted to configure a SAML SP automation service, but the specified SSO SAML object does not exist.
Impact:
The misconfigured SAML SP automation object is not saved.
Recommended Action:
Specify an existing SSO SAML object on the system.
01071d6d : IPv6 management addresses are unsupported in 1NIC mode.
Location:
/var/log/ltm, CLI
Conditions:
The BIG-IP Virtual Edition (VE) is in 1NIC mode, and an attempt is made to add an IPv6 address as a management IP address.
Impact:
Adding an IPv6 address for a management IP address is disallowed.
Recommended Action:
Do not use IPv6 addresses for the management-ip on a 1NIC VE.
01071d6e : SAML SSO server (%s) associated SAML SP metadata automation (%s) are not in the same partition.
Location:
/var/log/apm or GUI
Conditions:
An administrator has attempted to configure a SAML SP automation service, but the specified SSO SAML object is in a different administrative partition than the SAML SP metadata automation service.
Impact:
The misconfigured SAML SP automation object is not saved.
Recommended Action:
Ensure that the specified SSO SAML object is located in the same partition as the SAML SP metadata automation service.
01071d6f : SAML SP metadata automation (%s) contains invalid metadata URL value (%s). Error (%s).
Location:
/var/log/apm or GUI
Conditions:
An administrator has attempted to configure a SAML SP automation service, but at least one of specified metadata URLs is not valid.
Impact:
The misconfigured SAML SP automation object is not saved.
Recommended Action:
Specify a valid metadata URL.
01071d6f : The Traffic Acceleration FPGA is not allowed when TAM is not provisioned.
Location:
/var/log/ltm
Conditions:
The Traffic Acceleration FPGA firmware is loaded in the configuration, but Traffic Acceleration Module (TAM) is not provisioned.
Impact:
The configuration is rejected.
Recommended Action:
Provision TAM on the system and the Traffic Acceleration FPGA firmware will automatically be loaded. The FPGA firmware does not need to be manually changed.
01071d70 : SAML SP metadata automation (%s) must have server SSL profile configured.
Location:
/var/log/apm or GUI
Conditions:
An administrator has attempted to configure a SAML SP automation service. The administrator has specified at least one metadata URL that is protected by SSL, but has not specified a Server SSL profile to be used to connect to the remote server hosting the metadata file.
Impact:
The misconfigured SAML SP automation object is not saved.
Recommended Action:
Specify a Server SSL profile in the SAML SP automation service.
01071d70 : LDAP config (%s) must either have a matching client certificate and client key, or both of these fields must be empty.
Location:
/var/log/ltm, GUI, CLI
Conditions:
LDAP configuration contains either an SSL client certificate without a matching key or an SSL key without a matching certificate.
Impact:
Configuration is not accepted, and LDAP authentication will not work.
Recommended Action:
When configuring LDAP authentication with SSL, configure both an SSL client certificate and an SSL key.
01071d71 : SAML SP metadata automation (%s) must have DNS resolver configured.
Location:
/var/log/apm or GUI
Conditions:
An administrator has attempted to configure a SAML SP automation service, but a DNS resolver is not specified.
Impact:
The misconfigured SAML SP automation object is not saved.
Recommended Action:
Configure a DNS resolver on the SAML SP automation service.
01071d71 : Can't create scheduled-report (%s). You currently have %u scheduled-reports set, while this is above the max allowed scheduled-reports (%u).
Location:
/var/log/audit, /var/log/ltm, GUI, CLI
Conditions:
A user has created too many AVR scheduled-reports. The maximum number allowed is 100.
Impact:
No additional scheduled-reports can be created.
Recommended Action:
Delete unused scheduled-reports from the system to allow for new reports to be created.
01071d72 : Metadata URL (%s) value cannot be empty in SAML SP metadata automation (%s).
Location:
/var/log/apm or GUI
Conditions:
An administrator has attempted to configure a SAML SP automation service, but at least one of the specified metadata URLs does not contain any value.
Impact:
The misconfigured SAML SP automation object is not saved.
Recommended Action:
Specify a value for the specified metadata URL. All metadata URL objects configured as part of SAML SP automation service require a URL value.
01071d72 : %s.
Location:
/var/log/ltm
Conditions:
The mcpd debug log level is enabled (via tmsh modify sys db log.mcpd.level value debug) and the user modifies sys management-ip.
Impact:
Debug messages start to log.
Recommended Action:
None.
01071d73 : SAML SP metadata automation (%s) must specify value for sso-config-saml object.
Location:
/var/log/apm or GUI
Conditions:
An administrator attempts to configure a SAML SP automation service, but an attribute specifying the SSO SAML object has not been configured.
Impact:
The misconfigured SAML SP automation object is not saved.
Recommended Action:
Specify the SSO SAML object to be used by the SAML SP automation service.
01071d73 : The Traffic Accelerated virtual(%s) is required to have a destination address set
Location:
/var/log/ltm
Conditions:
The configuration contains a Traffic Acceleration Module (TAM) virtual server with either no destination address or the destination address 0.0.0.0.
Impact:
The configuration is rejected.
Recommended Action:
Add a valid Destination address to the TAM virtual server referenced in the error message.
01071d74 : SAML SP metadata automation (%s) contains duplicated URL value (%s).
Location:
/var/log/apm or GUI
Conditions:
An administrator has attempted to configure an SAML SP automation service, but the service contains duplicated URLs.
Impact:
The misconfigured SAML SP automation object is not saved.
Recommended Action:
Remove duplicated URLs from the configured AML SP automation service.
01071d74 : Anti-Fraud URL '%s' is invalid. Only SPA URLs and their views can have destination URLs in the Anti-Fraud profile '%s'.
Location:
/var/log/ltm, cli
Conditions:
There is an attempt to configure destination URLs for a protected URL that has no views.
Impact:
The configuration fails.
Recommended Action:
Only configure destination URLs either for a protected URL that has at least one view or for protected view.
01071d74 : Opening socket on interface %s failed: %s
Location:
/var/log/ltm, GUI, CLI
Conditions:
DHCP is disabled on a BIG-IP Virtual Edition (VE) that is in 1Nic mode.
Impact:
Validation fails.
Recommended Action:
Enable DHCP.
01071d75 : SAML SP connector (%s) cannot be deleted because it is managed by SP connector automation (%s).
Location:
/var/log/apm or GUI
Conditions:
An administrator has attempted to manually remove the SAML SP connector object that was created by SAML SP automation.
Impact:
The SP Connector object is not removed.
Recommended Action:
There are several ways to remove SP connector objects managed by an SP automation service:
1) Modify the SAML SP automation service to remove the metadata URL that was used to created the SP automation service. Note that when you remove the metadata URL, all SP connectors associated with this URL are deleted.
2) Remove the SP automation service. This action removes all SP connectors created by the service.
3) Not recommended: Use tmsh to change the “automation-object'” property of the SAML SP connector object to “none”, and then delete the SP connector manually. Note this this option is not recommended because the automation service might recreate the SP connector object later (for example. when the service restarts or the content of the remote metadata file changes).
01071d75 : Db variable %s(%u) should be greater than %s(%u).
Location:
/var/log/ltm
Conditions:
The value of the db variable "dos.dnsnxdomain.period" is less than or equal to the value of the variable "dos.dnsnxdomain.learnperiod".
Impact:
none.
Recommended Action:
Change the value of the db variable "dos.dnsnxdomain.period" to be greater than the value of the variable "dos.dnsnxdomain.learnperiod".
01071d75 : %s IP for interface %s failed: %s
Location:
/var/log/ltm, GUI, CLI.
Conditions:
DHCP is disabled on a BIG-IP VE in 1Nic mode.
Impact:
Validation fails.
Recommended Action:
Enable DHCP.
01071d76 : SAML SSO config (%s) is assigned to a SAML resource (%s), and therefore can only have one SP connector object associated with it.
Location:
/var/log/apm or GUI
Conditions:
An administrator has attempted to bind multiple SP connector objects to a SAML SSO object that is assigned to a SAML resource.
Impact:
The modified SAML SSO object configuration is not saved.
Recommended Action:
Specify a single SP connector only for a SAML SSO object that is assigned to a SAML resource. When multiple SP connectors are required, you can replicate the SAML SSO object as needed.
01071d76 : FDB MAC %s cannot be broadcast/multicast
Location:
/var/log/ltm, GUI, CLI
Conditions:
An attempt was made to add a multicast MAC address on a VLAN as a static entry to the FDB.
Impact:
Any attempt for adding a multicast MAC static FDB entry will be reported as a failure and the multicast MAC address will not be added to the FDB. For more information, see bug ID 681673 titled "tmsh modify FDB command permits multicast MAC addresses, which produces unexpected results".
Recommended Action:
Consider adding unicast MAC addresses as static FDB entries instead.
01071d77 : SAML SSO configuration (%s) cannot specify both (%s) and (%s) at the same time.
Location:
/var/log/apm, UI, CLI
Conditions:
An administrator has configured a SAML SSO (IdP) object on the BIG-IP system and the object specifies either of the following:
1) Both the signing certificate and the session variable referring to a signing certificate.
2) Both the signing key and session variable referring to a signing key.
Impact:
The created or modified SSO object is not saved.
Recommended Action:
Specify either the signing certificate or a session variable specifying the signing certificate, but not both. The same applies to a signing key.
01071d78 : Attribute (%s) in %s (%s) must be in session variable format
Location:
/var/log/apm, UI, CLI
Conditions:
The user has changed the BIG-IP configuration, but the provided value for the relevant attribute specified in the error message is not in APM session variable format.
Impact:
The modified configuration object is not saved.
Recommended Action:
Specify the relevant attribute in APM session variable format, for example:
"%{session.value}"
01071d79 : SAML Artifact Resolution Service (%s) is configured to sign requests. However, the correponding SAML SSO Config (%s) does not have signing %s configured. Please specify an IdP signing %s.
Location:
/var/log/apm, UI, CLI
Conditions:
An administrator has attempted to create or modify a SAML SSO (IdP) object, but either a certificate or a key is not configured on the SAML SSO object.
Impact:
The modified SAML SSO object configuration is not saved.
Recommended Action:
Configure both a signing certificate and a key on the specified SAML SSO object.
01071d79 : Interface %s cannot be used in passive/virtual-wire mode.
Location:
/var/log/ltm
Conditions:
An interface is set to Passive or Virtual Wire mode.
Impact:
The interface cannot be used in Passive or Virtual Wire mode.
Recommended Action:
Try configuring Virtual Wire or Passive mode on another port, one that is either not in use or is operating in Layer 3 (L3) mode. Note that changing the mode of a port currently operating in L3 mode to Virtual Wire mode results in changes to the network.
01071d7a : Master Key not yet ready. Delaying DNSSEC Key Generation Events for %u seconds.
Location:
/var/log/ltm
Conditions:
A DNSSEC key generation event occurs. For example, a key expires or rolls over, either before or during Master Key initialization. Generally, the only time this collision of events can occur is during a reboot or "bigstart restart" operation with a DNSSEC key that is configured to expire or roll over during the window of time that the box is offline or initializing.
Impact:
DNSSEC key generation events are delayed until the Master Key becomes available. This means the configuration will contain stale key generations until they can be successfully regenerated (that is, until the Master Key is initialized and available).
Recommended Action:
None.
01071d7b : Cannot assign access profile and both clientssl and serverssl profiles with ssl proxy enabled to the same virtual server (%s).
Location:
/var/log/ltm, GUI, CLI
Conditions:
The following profiles are attached to the same virtual server:
- clientssl with "proxy ssl" enabled
- serverssl with "proxy ssl" enabled
- access profile
Impact:
The configuration with these conditions is invalid and therefore rejected.
Recommended Action:
Change any of the listed conditions.
01071d83 : Failed to configure iptables rules for config sync CGC routing: %s
Location:
/var/log/ltm
Conditions:
The cgc-setup script indicates an error when mcpd tries to initialize the iptables rules and routing for config-sync.
Impact:
Config-sync might not work. This error message will include the output of the script, which contains additional clues as to why the script failed.
Recommended Action:
Review the specific error messages for details, and engage with F5 Support, if needed.
01071d84 : Configured iptables rules for config sync CGC routing: %s
Location:
/var/log/ltm
Conditions:
This is an informational message indicating the cgc-setup script ran correctly. This message is not reported unless log.mcpd.level is set to info or debug.
Impact:
This is an informational message.
Recommended Action:
None.
01071d85 : Config sync over the management port requires big3d, which is not currently running. Config sync will not work until big3d is running.
Location:
/var/log/ltm
Conditions:
This message is reported if config-sync is configured to use the management port and mcpd fails to detect big3d running at the time mcpd sets up the config sync network sockets.
You might also see this message if big3d is in the middle of restarting when mcpd checks for it, in which case config-sync operation starts as soon as big3d starts. If you see this message for this reason, you can ignore the message, as the situation corrects itself.
Impact:
Config-sync over the management port does not work without big3d.
If you have intentionally disabled big3d, you must re-enable it or reconfigure config sync to not use the management port.
Recommended Action:
Make sure big3d is enabled or do not use the management port for config sync.
01071d93 : Unable to find customization source (%s) for customization group (%s).
Location:
When you have specified a customization source of a customization group that does not exist on the device but customization source name validation passed it.
Error might be noticeable in CLI and logs for MCPD and LTM.
Conditions:
This message appears when a customization group is created or modified, and it has a customization source. The customization source name is validated before mcpd proceeds. If it appears that mcpd passed the customization source name as valid, but it has no corresponding object or files.
Impact:
Setting invalid customization source invalidates customization and it falls back to defaults.
Recommended Action:
No workaround.
01071d93 : Profile %s the set Certificate Chain Traversal Depth (authenticate-depth), %u, is invalid. This must be 0 (infinite) or between 1 and %u inclusive.
Location:
/var/log/ltm
Conditions:
An SSL profile is being created or modified, and the authenticate depth (also known as Certificate Chain Traversal Depth) is greater than 15.
Impact:
The profile is not saved.
Recommended Action:
When creating or modifying an SSL profile, use a value between 0 through 15 inclusive in the Certificate Chain Traversal Depth field.
01071d93 : Single-ip %s - cluster member IP address %s cannot be configured for cluster %s.
Location:
/var/log/ltm
Conditions:
The cluster single management IP feature is enabled, which causes the system to disallow configuration of the cluster member IP addresses.
Impact:
The system informs the user of the reason that the attempt to configure the cluster member IP addresses is denied.
Recommended Action:
Disable the cluster single management IP feature.
01071d94 : Bot Defense Profile (%s) Micro Service (%s): Missing required field (%s).
Location:
/var/log/ltm
Conditions:
ASM is provisioned and one of required fields is missing in the tmsh command.
Impact:
The system will not store the configuration in the mcp database.
Recommended Action:
Supply the required field in the tmsh command.
01071d95 : Per-request access policy (%s) is not referenced by any existing customization group set
Location:
/var/log/ltm, GUI, CLI
Conditions:
The user has not defined a Customization Group Set for a given Per-request Access Policy.
Impact:
The modified configuration cannot be loaded. If this is the initial configuration load, the BIG-IP system is non-operational.
Recommended Action:
Correct BIGIP configuration or changes to it by checking that each explicit definition of a Customization Group Set object refers to an existing Per-Request Access Policy object.
The description of a Customization Group Set object must contain an explicit reference to the name of an existing Per-Request Access Policy object:
apm policy customization-group-set /Common/test_rap_cgs {
access-policy /Common/test_rap
}
01071d95 : FipsUserMgr Error: %s.
Location:
The message is one of several internal errors that occurs when a BIG-IP device containing an NGFIPS or N3FIPS hardware accelerator fails to set up the FIPS accelerator.
Conditions:
[1] BIG-IP device contains an NGFIPS or N3FIPS accelerator.
[2] An internal error occurs due to one of the following:
- Command execution
- File, database table, and key access
- Setting up and accessing shared memory
- Accessing FIPS card
- Generating and processing random passwords and keys
- Login attempts to FIPS card
- Attempting to set up an N3FIPS accelerator on a vCMP Host
Impact:
[1] BIG-IP device fails to set up the FIPS accelerator.
[2] TMM fails to login to the FIPS accelerator, and does not start.
Recommended Action:
Although there is no workaround for this issue, you can use the following procedure to return to a previously working location and try the operation again.
Important: This procedure completely re-initializes the accelerator, so ensure you have copies of the private keys before proceeding, or have the encrypted ..exp. files and another FIPS accelerator in the same security domain from which you can .fips-card-sync. after re-initialization.
-- If the error state persists after restarting using 'bigstart restart' or 'tmsh sys services restart' you can use these steps:
1. Reboot back to the prior location where this was working.
2. Run the fipsutil command:
fipsutil init -f
3. Restart the BIG-IP system using either command:
-- bigstart restart
-- tmsh sys services restart
4. Delete the upgrade volume, reinstall the BIG-IP ISO file into a new volume, and boot into the new volume.
01071d96 : Failed to send DDL to PostgreSQL: %s
Location:
/var/log/ltm
Conditions:
The mcpd daemon is trying to populate the PostgreSQL database's structure.
Impact:
The content of the PostgreSQL database is not consistent.
Recommended Action:
None.
01071d96 : The customization group set (%s) cannot share an access policy (%s) with other customization group set (%s).
Location:
/var/log/ltm, GUI, CLI
Conditions:
The user has attempted to configure two Customization Group Set objects to refer to the same Per-Request Access Policy object. This configuration is not allowed.
Impact:
The modified configuration cannot be loaded. If this is the initial configuration load, the BIG-IP is non-operational.
Recommended Action:
Correct the BIG-IP system configuration or any changes to it by checking that each explicit definition of a Customization Group Set object refers to a unique, existing Per-Request Access Policy object. The description of a Customization Group Set object must contain an explicit reference to the name of an existing Per-Request Access Policy object:
apm policy customization-group-set /Common/test_rap_cgs {
access-policy /Common/test_rap
}
01071d97 : Anti-Fraud URL '%s' is invalid. URL path cannot have trailing slashes in the Anti-Fraud Profile '%s'.
Location:
var/log/ltm, cli
Conditions:
The name of the URL being created contains trailing slashes (in the path segment, not in query string).
Impact:
URL object creation fails.
Recommended Action:
Remove all trailing slashes from the URL's name (within the path segment only).
01071d97 : Access policy name cannot be changed in customization group set (%s)
Location:
/var/log/ltm, GUI, CLI
Conditions:
A user has attempted to change the name of the Per-Request Access Policy in an existing Customization Group Set object.
Impact:
The modified configuration cannot be loaded.
Recommended Action:
Check the name of the Per-Request Access Policy in modification commands for the named Customization Group Set object, or exclude the Access Policy name from these commands. Then repeat the modifications to the BIG-IP system configuration.
01071d98 : Customization group set (%s) does not refer to access policy
Location:
/var/log/ltm file, CLI, GUI
Conditions:
The named Customization Group Set object does not contain a Per-Request Access Policy object name. This is a mandatory attribute and must be included in any Customization Group Set object definition.
.
Impact:
The modified configuration cannot be loaded. If this is the initial configuration load, the BIG-IP system is non-operational.
Recommended Action:
Check all explicit Customization Group Set object definitions and add 'access-policy' attribute where necessary, for example:
apm policy customization-group-set /Common/test_rap_cgs {
access-policy /Common/test_rap
}
Any Per-Request Access Policy object name can be used only once in Customization Group Set object definitions.
01071d98 : Empty IP protocol name specified for rule (%s). Please specify a valid string corresponding to the IP protocol number.
Location:
/var/log/ltm
Conditions:
A custom script or other application has passed an empty/null string for "ip_protocol_name" when configuring firewall rule. Both GUI and tmsh specify "ip_protocol_name" string along with "ip_protocol" number when configuring firewall rule.
Impact:
Firewall rule configuration fails. If this is a "create" operation, the rule is not added into the configuration. If this is a "modify" operation, the rule is not modified.
Recommended Action:
When configuring a firewall rule, modify your client script/application to always specify the "ip_protocol_name" string along with the "ip_protocol" number.
01071d9b : PEM Gx/Sd reporting volume threshold cannot be smaller than 8K bytes.
Location:
CLI
Conditions:
A user has attempted to set the reporting volume threshold to a value smaller than 8KB.
Impact:
The configuration change request is denied.
Recommended Action:
None.
01071d9c : PEM Mandatory-Action-List cannot be set when Single-Rule-Match-Mode is disabled.
Location:
GUI, CLI
Conditions:
A user has tried to modify the PEM mandatory-action-list when single-rule-match-mode is disabled.
Impact:
The configuration change request is denied and an error message is displayed.
Recommended Action:
None.
01071d9d : Address Exclusion is not supported for Security NAT translation object (%s) of type %s.
Location:
GUI, CLI
Conditions:
An attempt is made to add an exclusion to the static NAT/static PAT object. Address exclusion is supported only on a dynamic PAT translation object.
Impact:
The configuration fails.
Recommended Action:
Remove the exclusion object from the static NAT/static PAT translation object.
01071d9d : Neighbor entry (%s) can not be resolved%s.
Location:
/var/log/ltm
Conditions:
There is no directly-connected network for the address.
Impact:
The static arp/ndp entry cannot be resolved. The condition prevents either:
1) The deletion of the self IP address or static route that could strand the static ARP entry, or
2) The creation of the static ARP entry.
Recommended Action:
If you are in the process of deleting a self IP address or static route entry, delete the static arp entry first. If you are in the process of creating a static ARP entry, create the network object that would make the IP address of the static arp entry reachable.
01071d9e : Bot defense anomaly %s not found.
Location:
/var/log/ltm
Conditions:
The ASM module is provisioned, a user has used an illegal tmsh/REST command, and within the tmsh/REST command, the mentioned anomaly name does not exist in the MCP database.
Impact:
The configuration is not stored in the MCP database.
Recommended Action:
None.
01071d9f : Bot defense anomaly category %s not found.
Location:
/var/log/ltm
Conditions:
The ASM module is provisioned, a user is using illegal tmsh/REST commands, and within the tmsh/REST command, the mentioned category name does not exist in the MCP database.
Impact:
The configuration is not stored in the MCP database.
Recommended Action:
None.
01071d9f : %s.
Location:
/var/log/ltm
Conditions:
MCPd has encountered an exception condition related to sending data to one or more processes. If this happens, the connection to that process will be shut down and an error message logged.
Impact:
The process that was communicating with MCPd will have it's connection severed, and it's expected that the process will automatically reconnect or restart.
n the event that the error message is logged *because* the process disconnected as part part of normal operations, there is no impact beyond useful diagnostic information.
If this message occurs frequently, it may indicate there is a problem. This can result in interruption of traffic processing and problems managing the system.
Recommended Action:
No action needed if the system is functioning normally.
Please contact F5 support if this message is occurring frequently and system is not functioning correctly.
01071da0 : Bot defense class %s not found.
Location:
/var/log/ltm
Conditions:
The ASM module is provisioned, a user is using illegal tmsh/REST commands, and within the tmsh/REST command, the mentioned class name does not exist in the MCP database.
Impact:
The configuration is not stored in the MCP database.
Recommended Action:
None.
01071da0 : %s.
Location:
/var/log/ltm
Conditions:
The mcpd daemon has encountered an exception condition related to sending data to one or more processes.
The associated process might have shut down or restarted as part of normal operations. The exception can also occur when the connection between mcpd and the associated process fails for an unknown reason.
Impact:
The connection for the process that was communicating with mcpd is severed, and it's expected that the process will either reconnect or restart.
In the event that the error message is logged because the process disconnected as part part of normal operations, there is no impact beyond useful diagnostic information.
If this message occurs frequently, it might indicate there is a problem. This can result in interruption of traffic processing and problems managing the system.
Recommended Action:
No action is needed if the system is functioning normally.
Please contact F5 support if this message is occurring frequently and the system is not functioning correctly.
01071da1 : %s: When %s is (%s) and %s (%s) is %s address, %s (%s) represents '%s %s addresses'.
Location:
/var/log/ltm
Conditions:
A user has added or modified the source/destination of dos.network-whitelist entries or extended-entries.
Impact:
This message provides detailed information about the semantic meanings of ip-address 'any' and 'any6'. The meanings of 'any' and 'any6' vary depending on the value of match-ip-version.
Recommended Action:
Inspect the relevant object configuration and make sure that the semantics of 'any' and 'any6' with match-ip-version are correctly configured. To see the log, the user must set the "sys db log.mcpd.level" value to "info".
01071da2 : Virtual Server %s's Traffic Matching Criteria %s illegally shares destination address, source address, service port, and ip-protocol with Virtual Server %s's Traffic Matching Criteria %s.
Location:
/var/log/ltm, TMSH, iControl REST, GUI
Conditions:
A new virtual server has been created with traffic-matching criteria that has an IP protocol, IP address, and destination port combination that overlaps with the traffic-matching criteria of an existing virtual server.
Impact:
The system rejects the creation of the new virtual server.
Recommended Action:
Modify the traffic-matching criteria of the new virtual server to avoid overlaps.
01071da2 : Blacklist-category %s must have match type destination to enable scrubbing.
Location:
GUI, CLI
Conditions:
A user has attempted to enable scrubbing on a blacklist category using the command "modify security scrubber profile scrubber-profile-default scrubber-categories add ...", and the match type for the blacklist category is not set to the match type "Destination".
Impact:
Enabling the scrubbing on the blacklist category fails.
Recommended Action:
Modify the match type to "Destination" before enabling the scrubbing on the blacklist category.
01071da3 : Virtual Server %s's Traffic Matching Criteria %s illegally shares destination address, source address, service port, and ip-protocol with Virtual Server %s destination address, source address, service port.
Location:
/var/log/ltm, GUI, CLI, API
Conditions:
A virtual server has been created with traffic-matching criteria that has an IP protocol, IP address, and destination port combination that overlaps with an existing virtual server.
Impact:
The system rejects the creation of the new virtual server.
Recommended Action:
Modify the traffic-matching criteria of the new virtual server to avoid overlaps.
01071da3 : Cannot change match type to source or source-and-destination if scrubbing is enabled on the blacklist category. Disable scrubbing before changing the match type.
Location:
GUI, CLI
Conditions:
A user has attempted to change the match type of the blacklist category to a value other than "Destination", and the user has already enabled the scrubbing on this category.
Impact:
The modification of the match type to a value other than "Destination" fails.
Recommended Action:
Disable the scrubbing on the blacklist category before attempting to modify the match type to a value other than "Destination".
01071da4 : Uri Type %s out of its minimum %d or maximum %d characters range.
Location:
CLI
Conditions:
A user has specified a Uri Type name value and file-extensions values that are outside of the allowed range in character length. The values must fit conditions in the error message.
Impact:
The TMSH command fails, and the configuration is not saved.
Recommended Action:
Ensure that the values fit the conditions specified in the error message. See the command 'tmsh help analytics uri-type" for more information.
01071da5 : Uri Type must have at least %d %s associated with it.
Location:
CLI
Conditions:
A user has attempted to create a Uri Type without any file extensions, or has attempted to delete all values from the file-extensions list. The file-extensions list must contain at least one value.
Impact:
The TMSH command fails, and the configuration is not changed.
Recommended Action:
Ensure that the file-extensions list contains at least one value. For more information, see the command "tmsh help analytics uri-type".
01071da6 : No more than %d total file extensions can be defined (across all Uri Types).
Location:
CLI
Conditions:
A user has attempted to specify a value that exceeds the maximum number of Uri Type file-extensions allowed.
Impact:
The TMSH command fails, and the configuration is not saved.
Recommended Action:
Try to delete unused file-extensions and replace them with new ones. For more information, see the command "tmsh help analytics uri-type".
01071da7 : No more than %d total Uri Types can be defined.
Location:
CLI
Conditions:
A user has attempted to define more than the maximum number of Uri types allowed.
Impact:
The TMSH command fails, and the configuration is not saved.
Recommended Action:
Try to delete unused Uri types and replace them with new ones. For more information, see the command "tmsh help analytics uri-type".
01071da8 : File extension '%s' already exists in '%s' Uri Type.
Location:
CLI
Conditions:
A user has attempted to define file extensions that already exist on the system, thereby attempting to share the same file extensions across multiple Uri Type configuration objects.
Impact:
The TMSH command fails, and the configuration is not saved.
Recommended Action:
Ensure that you create unique file extensions across all Uri Types, rather than creating duplicates file extensions. For more information, see the command "tmsh help analytics uri-type".
01071da9 : Uri Type objects must be in the '%s' folder only.
Location:
CLI
Conditions:
A user has attempted to create a Uri Type object in a folder (administrative partition) that is not "/Common".
Impact:
The TMSH command fails, and the configuration is not saved.
Recommended Action:
Do not prefix the Uri Type name with any folder name other than "/Common/". For more information, see the command "tmsh help analytics uri-type".
01071daa : %s
Location:
CLI
Conditions:
One of the characters in the Uri Type name or file-extensions values is invalid.
Impact:
The TMSH command fails, and the configuration is not saved.
Recommended Action:
Use only allowed characters in names. For more information, see the error output. Usually these properties only support alphanumeric characters, digits, and "-" or "_", as in "[a-zA-Z0-9_-]". The Uri Type name must start with an alphanumeric character.
The file-extensions values must use lower-case characters only. For more information, see "tmsh help analytics uri-type".
01071dac : Bot signature category %s not found.
Location:
GUI, CLI, API
Conditions:
ASM is provisioned, and within the TMSH/REST command used, the mentioned category name does not exist in the MCP database.
Impact:
The configuration will not be stored in the MCP database.
Recommended Action:
None.
01071dac : Cannot change match type to destination or source-and-destination if blacklist publisher profile is attached to the category.
Location:
GUI, CLI
Conditions:
A user has tried to change the match type of the IP intelligence blacklist category, if the category has blacklist publisher configuration enabled.
Impact:
The match type is not allowed to change to destination or source-and-destination without first removing the category from the blacklist publisher.
Recommended Action:
None.
01071dad : Bot defense profile (%s) class override (%s) error: %s.
Location:
GUI, CLI, API
Conditions:
The ASM module is provisioned, and the TMSH command contains incorrect values.
Impact:
The configuration is not stored in the MCP database.
Recommended Action:
None.
01071dad : Policy '%s', rule '%s'; target '%s' action '%s' cannot have same fallback pool (%s) and default pool (%s).
Location:
/var/log/ltm
Conditions:
A fallback pool and the default (primary) pool in an LTM policy action have the same value.
rules {
1 {
actions {
1 {
forward
select
fallback-pool http_pool <------ The pool and fallback pool can't be same.
pool http_pool
}
}
}
}
Impact:
The LTM policy won't compile.
Recommended Action:
None.
01071dae : Bot Defense Profile (%s) Micro Service (%s): %s.
Location:
GUI, CLI, API
Conditions:
The ASM module is provisioned, and the TMSH command contains incorrect values.
Impact:
The configuration is not stored in the MCP database.
Recommended Action:
None.
01071dae : Policy '%s', rule '%s'; target '%s' action '%s' requires default pool. Please specify default pool along with fallback pool (%s).
Location:
/var/log/ltm
Conditions:
When "fallback-pool" parameter is specified without the "pool" parameter in LTM policy action.
rules {
1 {
actions {
1 {
forward
select
fallback-pool http_pool <---- The default pool is missing.
}
}
}
}
Impact:
The LTM policy won't compile.
Recommended Action:
None.
01071daf : Bot Defense Profile (%s) Micro Service (%s) Url (%s): %s.
Location:
GUI, CLI, API
Conditions:
The ASM module is provisioned, and the TMSH command contains incorrect values.
Impact:
The configuration is not stored in the MCP database.
Recommended Action:
None.
01071daf : Throwing Invalid Monitor Rule Instance: %s
Location:
/var/log/ltm
Conditions:
MCPD logs this message before an "Invalid monitor rule instance identifier" error is logged.
Impact:
No impact. This is information only.
Recommended Action:
None.
01071db0 : Throwing Invalid Monitor Rule Instance: %s
Location:
/var/log/ltm
Conditions:
MCPD logs this message before an "Invalid monitor rule instance identifier" error is logged.
Impact:
No impact. This is information only.
Recommended Action:
None.
01071db0 : %s %s.
Location:
/var/log/ltm, GUI, CLI
Conditions:
Product management has configured flexible notifications in the license file. , .
Impact:
No functional impact. The BIG-IP system generates the notifications with the given string in the license file. This is a notification to customers to remind them about license renewal.
Recommended Action:
None.
01071db1 : Bot defense profile (%s) Signature (%s) should be Mobile Application Class signature.
Location:
GUI, CLI, API
Conditions:
ASM is provisioned, and the TMSH command contains incorrect values.
Impact:
The configuration will not be stored in the MCP database.
Recommended Action:
When you are defining a mobile signature on a bot defense profile, ensure that the signature is of a category that belongs to a class named "Mobile Application".
01071db1 : Throwing Invalid Monitor Rule Instance: %s
Location:
/var/log/ltm
Conditions:
MCPD logs this message before an "Invalid monitor rule instance identifier" error is logged.
Impact:
No impact. This is information only.
Recommended Action:
None.
01071db2 : Bot defense signature category illegal class (%s).
Location:
GUI, CLI, API
Conditions:
ASM is provisioned, and the values within the TMSH command are incorrect. It is illegal to set a Browser or Unknown bot defense class for a signature category.
Impact:
The configuration will not be stored in the MCP database.
Recommended Action:
None.
01071db2 : Throwing Invalid Monitor Rule Instance: %s
Location:
/var/log/ltm
Conditions:
MCPD logs this message before an "Invalid monitor rule instance identifier" error is logged.
Impact:
No impact. This is information only.
Recommended Action:
None.
01071db3 : Bot defense profile (%s) signature category override not supported for (%s) which belongs to (%s) class.
Location:
GUI, CLI, API
Conditions:
ASM is provisioned, the TMSH command contains incorrect values It is illegal to define override settings for several signature categories, for example, categories of mobile signatures.
Impact:
The configuration will not be stored in the MCP database.
Recommended Action:
None.
01071db3 : Throwing Invalid Monitor Rule Instance: %s
Location:
/var/log/ltm
Conditions:
MCPD logs this message before an "Invalid monitor rule instance identifier" error is logged.
Impact:
No impact. This is information only.
Recommended Action:
None.
01071db4 : Bot defense profile (%s) signature override not supported for (%s) which belongs to (%s) class.
Location:
GUI, CLI, API
Conditions:
ASM provisioned, and the TMSH command contains incorrect values. It is illegal to define override settings for a signature that belongs to a category that cannot be overidden, such as mobile signatures.
Impact:
The configuration will not be stored in the MCP database.
Recommended Action:
None.
01071db4 : Removing monitor rule instance: %s
Location:
/var/log/ltm
Conditions:
This message occurs under either of these conditions:
1. A monitor has been removed from a node, pool member, or a pool with one or more pool members.
2. A node, pool member, or a pool with one or more pool members that has a monitor attached is deleted.
Impact:
No impact. This is information only.
Recommended Action:
None.
01071db5 : Bot defense profile (%s) Micro Service (%s) class override (%s) error: %s.
Location:
/var/log/ltm, CLI, API
Conditions:
ASM is provisioned, and the TMSH command contains incorrect values. It is illegal to define override settings for a class on a micro service level; the exception is the "Trusted Bot" class.
Impact:
The configuration will not be stored in the MCP database.
Recommended Action:
None.
01071db5 : Saving monitor rule instance: %s
Location:
/var/log/ltm
Conditions:
A monitor is attached to a node, pool member, or a pool that contains one or more pool members.
Impact:
No impact. This is information only.
Recommended Action:
None.
01071db6 : Bot defense profile (%s) error: %s.
Location:
/var/log/ltm, CLI, API
Conditions:
ASM is provisioned, and the TMSH command contains incorrect values.
Impact:
The configuration will not be stored in the MCP database. The error is a generic template for arbitrary error messages resulting from MCP validation code; the specific error description is appended to the end of the error message after "error:".
Recommended Action:
None.
01071db6 : Creating a new monitor rule instance: %s
Location:
/var/log/ltm
Conditions:
A monitor is attached to a node, pool member, or a pool that contains one or more pool members.
Impact:
No impact. This is information only.
Recommended Action:
None.
01071dba : Warning (%s): %u bit keysize is insecure, it will be disabled in the future.
Location:
/var/log/ltm, GUI, CLI
Conditions:
A user has created 512-bit RSA/DSA keys, which are insecure.
Impact:
The system displays a warning message that it might not support the creation of 512-bit RSA/SDA keys in the future.
Recommended Action:
None.
01071dba : Cannot delete SSO configuration (%s) because it is referenced by a SSO configuration select agent (%s)
Location:
/var/log/ltm, GUI
Conditions:
A user has attempted to remove an SSO configuration that is referenced by an SSO configuration select agent.
Impact:
The SSO configuration will not be deleted.
Recommended Action:
Remove all references from SSO configuration select agents to a given SSO configuration before the SSO configuration is removed. Once the references are removed, attempts to delete the SSO configuration should succeed.
01071dbc : Fail to commit due to the preset autodiscovery-enable VS number limit is %d.
Location:
CLI
Conditions:
A user has attempted to enable auto-discovery on a virtual server, which causes the number of auto-discovery-enabled virtual servers to exceed the value in the database.
Impact:
Minimal. This message is for a specific case only.
Recommended Action:
Consider modifying the BigDB variable "auto.discover.mvs.count" to the desired value.
01071dbd : Fail to change the value to be less than the current number (%d) of VS that enables auto_discovery.
Location:
CLI
Conditions:
The existing number of virtual servers that enable auto-discovery is larger than the desired value.
Impact:
Minimal.
Recommended Action:
Consider changing the desired value to be not less than the existing number, or disabling the auto-discovery service on some of the virtual servers first.
01071dbf : Setting DB variable %s to %s. Restarting services.
Location:
/var/log/ltm
Conditions:
The BIG-IP VE device (non-cloud and cloud editions) did not have a FIPS 140-2 Level 1 license, and a FIPS 140-2 Level 1 license has been procured and installed.
Impact:
Processes are restarted, and the prompt changes back to the normal prompt. No reboot is required. A new log message indicating that processes are restarting is now present.
Recommended Action:
None.
01071dbf : The requested otp source (%s) is invalid: %s
Location:
/var/log/ltm, VPE UI, CLI
Conditions:
An administrator has attempted to define a custom session variable for an invalid OTP source in an access per-session OTP verify agent.
Impact:
An OTP source field cannot be configured in a per-session OTP Verify agent. Such an attempt might lead to authentication failures for APM end users.
Recommended Action:
None.
01071dc0 : %s changing OpenSSL FIPS flag from (%d) to (%d). Restarting services.
Location:
/var/log/ltm
Conditions:
The BIG-IP VE device (non-cloud and cloud editions) did not have a FIPS 140-2 Level 1 license, and a FIPS 140-2 Level 1 license has been procured and installed.
Impact:
Processes are restarted, and the prompt changes back to the normal prompt. In particular, processes linking with the system OpenSSL's libcrypto* restart and execute FIPS 140-2-specific code paths present in libcrypto*. A new log message indicating that system OpenSSL is switching to FIPS mode and that associated processes are restarting is now present.
Recommended Action:
None.
01071dc5 : The Group SIDs session variable name in AAA Kerberos agent (%s) is empty
Location:
/var/log/ltm
Also observed in TMSH.
Conditions:
When the configured session variable name is empty for Group SIDs when 'Extract Group SIDs' is Enabled in Kerberos Auth agent.
Impact:
Error message is logged and also printed in TMSH, preventing you from creating the invalid configuration.
Recommended Action:
Fix the error conditions by defining a value for the corresponding session variable.
01071dc6 : The Group SIDs session variable name '%s' in AAA Kerberos agent (%s) is invalid
Location:
/var/log/ltm. Also appears in TMSH and the Visual Policy Editor (VPE) in TMUI (GUI).
Conditions:
When you configure a session variable whose name is longer than 247 characters (%{session_var_name} has a maximum 250 chars, so name inside %{} must be reduced by 3 characters), or contains an asterisk * or space characters for Group SIDs in Kerberos Auth agent.
Impact:
Error message is logged and also printed in GUI or TMSH, preventing you from creating an invalid configuration.
Recommended Action:
Fix the error conditions causing the invalid configuration.
01071dc7 : The %s session variable name in AAA Active Directory agent (%s) is empty
Location:
/var/log/ltm
Also observed in TMSH.
Conditions:
When the configured session variable name is empty for Group SIDs or Group Names in AD Group SID Resolver agent.
Impact:
Error message is logged and also printed in TMSH, preventing you from creating the invalid configuration.
Recommended Action:
Fix the error conditions by defining a value for the corresponding session variable.
01071dcd : Keytab file is not specified for AAA Active Directory Server (%s)
Location:
-- /var/log/apm.
-- On the TMUI while adding/modifying the Active Directory server properties
Conditions:
This error happens only when the Active Directory server's 'kdc-validation' property is enabled while adding/modifying an Active Directory server, and the corresponding 'keytab-file-obj' property is not specified.
Impact:
Corresponding KDC (Key Distribution Centre) cannot be validated while performing ADAuth.
Recommended Action:
No workaround. The 'keytab-file-obj' property has to be set whenever the property 'key-validation' is enabled while adding/modifying an Active Directory server on BIG-IP systems.
01071dce : Service name is not specified for AAA Active Directory Server (%s)
Location:
-- /var/log/apm.
-- On the TMUI while adding/modifying the Active Directory server properties
Conditions:
This error happens only when the Active Directory server's 'kdc-validation' property is enabled while adding/modifying an Active Directory server, and the corresponding 'service-name' property is not specified.
Impact:
Corresponding KDC (Key Distribution Centre) cannot be validated while performing ADAuth.
Recommended Action:
No workaround. The 'service-name' property has to be set whenever the property 'key-validation' is enabled while adding/modifying an Active Directory server on BIG-IP systems.
01071dd4 : DOS Profile (%s) cannot be attached to Zone as it is BDOS enabled.
Location:
/var/log/ltm
Conditions:
DoS profile has BDOS enabled and it is being attached to the Zone.
Impact:
DoS profile is not attached to the Zone.
Recommended Action:
Disable BDOS on the DoS profile and then attach it to the Zone.
Note: If the DoS profile being modified is already attached to another object (e.g., a virtual server), then BDOS is disabled for that object.
01071dd8 : SIP cannot be enabled on the DOS profile (%s) as it is already attached to zone.
Location:
/var/log/ltm
Conditions:
SIP cannot be enabled on a particular DoS profile if that DoS profile is already attached to a Zone.
Impact:
DoS profile attached to a Zone cannot have SIP enabled.
Recommended Action:
Detach DoS profile from the Zone and then enable SIP on the DoS profile.
Note: If the DoS profile being modified is already attached to another object (e.g., a virtual server), SIP DoS is enabled on that object.
01071dd9 : VLAN (%s) cannot be attached to Zone (%s) as it is part of another Zone (%s) which is also has DOS profile attached.
Location:
/var/log/ltm
Conditions:
One VLAN cannot be attached to two Zones simultaneously, if both Zones have DoS Profiles configured.
Impact:
Only one VLAN can be attached to one Zone at a time with a DoS profile attached.
Recommended Action:
Do one of the following:
-- Detach the VLAN from the first zone and attach the VLAN to the second Zone.
-- Detach the DoS profile from one of the zones.
Impact of detaching the VLAN from the Zone:
If the Zone being modified is already attached to another object, such as ACL, the ACL rules will not be applied to the VLAN that is removed from the Zone.
01071ddc : DOS Profile (%s) cannot be attached to the Zone as SIP is enabled on the profile.
Location:
/var/log/ltm
Conditions:
The DoS profile that is being attached to the Zone has SIP enabled.
Impact:
DoS profile is not attached to the Zone.
Recommended Action:
Disable SIP from DoS profile and then attach to the Zone.
Note: If the DoS profile being modified is already attached to another object (e.g., a virtual server), SIP DoS is disabled on that object.
01071ddc : DOS Profile (%s) cannot be attached to the Zone (%s) as the profile has Bad Actor/Attacked Destination Detection enabled.
Location:
/var/log/ltm
Conditions:
The DoS profile that is being attached to the Zone has Bad Actor/Attacked Destination Detection enabled.
Impact:
DoS profile is not attached to the Zone.
Recommended Action:
Disable Bad Actor/Attacked from the DoS profile and then attach it to the Zone.
01071dde : Log profile (%s) cannot be found.
Location:
/var/log/ltm
Conditions:
Log profile that is being attached to the Zone is not configured.
Impact:
Log profile cannot be attached to the zone.
Recommended Action:
Create the Log profile first, and then attach the profile to the Zone.
01071de0 : Dos profile (%s) cannot be attached to Protected-zone as BDOS is enabled.
Location:
/var/log/ltm
Conditions:
DoS profile is already attached to a Zone, and BDOS is being enabled.
Impact:
BDOS cannot be enabled on the DoS profile.
Recommended Action:
Detach DoS profile from Zone and then enable BDOS.
Note: If the DoS profile being modified is already attached to another object (e.g., a virtual server), then BDOS is enabled for that object.
01071de3 : Vector Threshold Mode cannot be enabled on the DOS profile (%s) as it is already attached to a Protected-zone.
Location:
/var/log/ltm
Conditions:
-- A DoS profile is attached to a Zone.
-- A Vector Threshold mode that is not 'Fully Manual' is being enabled on it.
Impact:
The Vector Threshold mode other than 'Fully Manual' is not enabled on the DoS profile.
Recommended Action:
Detach the DoS profile from the Zone and then enable the desired Vector Threshold mode.
Note: If the DoS profile being modified is already attached to another object (e.g., a virtual server), the Vector Threshold mode is changed for that object.
01071de4 : DNS cannot be enabled on the DOS profile (%s) as it is already attached to zone.
Location:
/var/log/ltm
Conditions:
DNS cannot be enabled on a particular DoS profile if that DoS profile is already attached to a Zone.
Impact:
DoS profile attached to a Zone cannot have DNS enabled.
Recommended Action:
Detach DoS profile from the Zone and then enable DNS on the DoS profile.
Note: If the DoS profile being modified is already attached to another object (e.g., a virtual server), DNS DoS is enabled for that object.
01071de5 : DOS Profile (%s) cannot be attached to the Zone as DNS is enabled on the profile.
Location:
/var/log/ltm
Conditions:
The DoS profile that is being attached to the Zone has DNS enabled.
Impact:
DoS profile is not attached to the Zone.
Recommended Action:
Disable DNS from the DoS profile and then attach it to the Zone.
Note: If the DoS profile being modified is already attached to another object (e.g., a virtual server), DNS DoS is disabled for that object.
01071e02 : DOS profile (%s) not found.
Location:
/var/log/ltm
Conditions:
DoS profile being attached to the Zone has not been configured.
Impact:
DoS profile specified cannot be attached to the Zone.
Recommended Action:
Create the DoS profile, and then attach it with Zone.
01071e03 : Maximum (%s) can be attached per Zone containing DOS profiles.
Location:
/var/log/ltm
Conditions:
16 Zones are already attached with DoS profiles, and an additional Zone is being attached with a DoS profile.
Impact:
DoS profile cannot be attached to the Zone.
Recommended Action:
Detach a DoS profile from one of the existing Zones, and then attach the DoS profile to the new Zone.
01071e09 : DOS Profile (%s) cannot be attached to zone as threshold mode is not Fully Manual.
Location:
/var/log/ltm
Conditions:
-- A DoS profile is attached to a Zone.
-- A Vector Threshold mode that is not 'Fully Manual' is being enabled on it.
Impact:
DoS profile is not attached to the Zone.
Recommended Action:
Set the Vector Threshold mode of the DoS profile being attached to the Zone 'Fully manual'.
Note: If the DoS profile being modified is already attached to another object (e.g., a virtual server), the Vector Threshold mode is changed for that object.
01071e0d : Security log profiles '%s' and '%s' cannot be associated simultaneously with a Zone '%s', since they have same or mutually exclusive parts enabled.
Location:
/var/log/ltm
Conditions:
The security log profiles have the same parts enabled and are being attached to the same Zone.
Impact:
Log profile is not attached to the Zone.
Recommended Action:
Ensure that log profiles have only mutually exclusive parts enabled, and then attach them to the Zone.
Note: If the log profile being modified is already attached to another object (e.g., a virtual server), the parts being changed affect that object.
01071e0e : Security log profiles '%s' and '%s' cannot be associated simultaneously with a Zone '%s', since they both have local logging enabled.
Location:
/var/log/ltm
Conditions:
Zone has a security log profile with local logging enabled and another security log profile with local logging enabled is being attached to the Zone.
Impact:
Log profile cannot be attached to the Zone.
Recommended Action:
Disable local logging on the log profile and then attach to the Zone.
Note: If the log profile being modified is already attached to another object (e.g., a virtual server), local logging will be disabled for that object.
01071e0f : DOS profile (%s) cannot be attached to the Zone (%s) as the Zone has one or more VLANs that are part of other Zones and a VLAN cannot be a member of more than one Zone which have DDoS protections enabled.
Location:
/var/log/ltm
Conditions:
DoS profiles cannot be attached to two Zones simultaneously, if both Zones have the same VLAN configured.
Impact:
DoS profile can be attached to only one Zone at a time with a VLAN attached.
Recommended Action:
Do either of the following:
-- Detach the VLAN from Zone and attach DOS profile to it.
-- Detach the DoS profile from the first Zone and attach the DoS profile to another Zone.
Impact of detaching the VLAN from the Zone:
-- If the Zone being modified is already attached to another object, such as ACL, then the ACL rules will not be applied to the VLAN that was removed from the Zone.
01073035 : The encryption key for OAuth profile (%s) cannot be modified directly. Use encryption secret to generate a new encryption key.
Location:
/var/log/apm, TMSH
Conditions:
If jwt-refresh-token-enc-key is specified directly.
Impact:
Object won't be saved.
Recommended Action:
Do not specify key. Instead use jwt-refresh-token-enc-secret to generate key.
01073039 : All the JWK configs in a JWT config must have unique cert-thumbprint-sha1. The cert-thumbprint-sha1 '%s' is already present in JWT config '%s'.
Location:
/var/log/ltm, tmsh, GUI
Conditions:
Misconfiguration.
Admin attempts to add a JWK config to a JWT config, and the JWK config has cert-thumbprint-sha1 that is already present in the JWT config through some other JWK config. The cert-thumbprint-sha1 must be unique within a JWT config.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
When attempting to add a JWK config to a JWT config, check that the operation will not result in a JWT config with more than one instance of the same cert-thumbprint-sha1.
01073040 : All the JWK configs in a JWT config must have unique cert-thumbprint-sha256. The cert-thumbprint-sha256 '%s' is already present in JWT config '%s'.
Location:
/var/log/ltm, tmsh, GUI
Conditions:
Misconfiguration.
Admin attempts to add a JWK config to a JWT config, and the JWK config has cert-thumbprint-sha256 that is already present in the JWT config through some other JWK config. The cert-thumbprint-sha256 must be unique within a JWT config.
Impact:
This is an mcp configuration error. Object containing this configuration will not be saved.
Recommended Action:
When attempting to add a JWK config to a JWT config, check that the operation will not result in a JWT config with more than one instance of the same cert-thumbprint-sha256.
010c0009 : Lost connection to mcpd - reestablishing
Location:
/var/log/ltm. Neither the Console nor the GUI provides it.
Conditions:
When SOD loses its connection to MCPD for whatever reason, this message is logged.
Impact:
SOD won't have communication with MCPD. Any device status/configuration updates wouldn't be possible until the communication is re-established.
Recommended Action:
If the connection is not re-established automatically, try restarting all services with bigstart restart.
010c0018 : Standby
Location:
/var/log/ltm. The GUI provides other prompts that indicate a device is in Standby mode; and the Console provides a prompt with Standby State in it.
Conditions:
A device goes to standby by user manual intervention, or when some other device is the active one in the failover group.
Impact:
If it is due to a user intervention, all failover objects in the device will be serviced by the next active device in the failover group, for example, traffic groups.
Recommended Action:
None.
010c0022 : Opening %s for failover monitoring
Location:
/var/log/ltm.
Conditions:
This log is informational and indicates that SOD has opened the failover serial port. This occurs on the startup of SOD. The use of the serial port for failover status is determined by the configuration of the BIG-IP.
Example:
Nov 11 07:35:13 lead info sod[6502]: 010c0022:6: Opening /dev/tty01 for failover monitoring.
Impact:
None.
Recommended Action:
None.
010c002a : Requesting tmm to resend gratuitous arps for traffic group %s.
Location:
/var/log/ltm
Conditions:
In an Active-Active scenario, once it is decided which device will become standby and which will remain active (internal logic), the active device will request tmm to resend gratuitous arp messages. When this occurs, this log message appears in the device that remained active.
Impact:
None.
Recommended Action:
None.
010c002b : Traffic group %s received a targeted failover command for %s.
Location:
/var/log/ltm
Conditions:
This log entry appears when the active device has received and is processing a targeted-failover command that is issued by an administrator for a specified traffic group.
Impact:
This is an informational log entry that indicates that the administrator has issued a failover for a specific traffic group on the active device.
Recommended Action:
None.
010c002c : Traffic group %s received a targeted failover command from cluster mate for %s.
Location:
/var/log/ltm
Conditions:
This log message appears when a blade in a cluster has received and is processing a targeted-failover command from one of the other blades in the cluster for a specified traffic group.
Impact:
This is an informational log message that indicates that the administrator has issued a failover for a specific traffic group in a cluster and this blade is processing that command.
Recommended Action:
None.
010c002d : Traffic group %s going standby via targeted failover command.
Location:
/var/log/ltm
Conditions:
This log message appears when a specified traffic group is going from active to standby, caused by a targeted-failover command that is issued by an administrator for a specified traffic group.
Impact:
This is an informational log message that indicates that the administrator has issued a targeted failover command to change a specific traffic group from an active to standby. device.
Recommended Action:
None.
010c0037 : Up service module error %s.
Location:
/var/log/ltm
Conditions:
These messages indicate that the failover daemon encountered an unexpected system call failure, and is not functioning correctly.
If the specific message is "Up service module error: .... Too many open files", then the system is probably running a version of software that contains defect Bug ID 451917 or Bug 516669.
Any other runtime errors require diagnosis.
Impact:
If this condition occurs, HA failover might not work correctly.
Recommended Action:
Depending on the root cause of the runtime error, restarting the BIG-IP device might clear the condition.
Upgrade to a BIG-IP software release that contains the fixes for Bug 451917 and Bug 516669.
010c003b : Bind fails on %s addr %s port %d error %s
Location:
/var/log/ltm
Conditions:
An invalid address has been configured as a unicast address on the device.
Impact:
The invalid unicast address cannot be used to send or receive network failover data.
Recommended Action:
Change the unicast address to be a valid management IP or self-IP.
010c003c : Connect fails on %s addr %s port %d error %s
Location:
/var/log/ltm
Conditions:
The code paths in question can only be executed if secure network failover is enabled. This error can occur if no route exists to the remote unicast address ("Network is Unreachable").
Impact:
Network failover communication to the remote unicast address does not work.
Recommended Action:
Repair the network partition.
010c003e : Offline
Location:
/var/log/ltm
If this offline state was requested by the user, the GUI provides other status fields that indicate a device is in Forced Offline mode, and the Console provides a prompt with ForcedOffline State in it.
Conditions:
It is a transitional state that is logged when the device comes up or when SOD restarts.
It will also occur when the user forces a device to stay offline.
The device encounters networking problems.
Impact:
Device won't be online. Network connectivity for services won't be available.
Recommended Action:
Bring the device back online if the offline state was a consequence of a user action.
Restart sod daemon. If that doesn't work, restart all services.
010c003f : Forced offline
Location:
/var/log/ltm
Conditions:
This log message occurs when the SOD updates an internal state to offline as a result of detecting that a traffic group has been forced offline by the admin.
Impact:
The log (level Notice) is generated by SOD after it changes an internal state for a traffic group has been forced offline and is no longer accessible to the user. This log is an informational/debug log of a SOD internal state change to forced offline and not that useful to the user.
Recommended Action:
None.
010c0044 : Command: %s
Location:
The message appears only in /var/log/ltm. It does not appear on the console or on the GUI screen.
Conditions:
This is a log entry that displays a failover command, executed by means of the GUI, tmsh, or iControl. The following examples show some of the possible logs, but not all.
The following log corresponds to making a traffic group go to standby from the GUI.
010c0044:5: Command: go standby /Common/TG2 /Common/BIGIP-2.localdomain GUI.
The following log corresponds to making a traffic group go to standby from tmsh.
010c0044:5: Command: go standby /Common/TG2 /Common/BIGIP-1.localdomain tmsh.
The following when making the BIGIP go ForcedOffline mode via tmsh
010c0044:5: Command: go offline all tmsh.
The following when making the BIGIP come back online from ForcedOffline mode via GUI
010c0044:5: Command: release offline all GUI.
The following log comes when making the BIGIP go offline from iControl
010c0044:5: Command: go offline all iControl.
Impact:
None. This is a notification that a system failover command was executed.
Recommended Action:
None.
010c0048 : Bcm56xxd and lacpd connected - links up
Location:
/var/log/ltm
Conditions:
This message is information, and is logged by SOD when the links to Bcm56xxd and lacpd are up. This is part of the normal startup process for SOD.
Example:
Nov 11 07:36:15 lead notice sod[6502]: 010c0048:5: Bcm56xxd and lacpd connected - links up.
Impact:
None
Recommended Action:
None.
010c0049 : Tmm ready - links up.
Location:
/var/log/ltm
Conditions:
This is a message from SOD to indicate that the TMM has reached the running state, and can handle passing and receiving traffic on the self-IPs often used for failover addresses.
This message is seen on initial startup, as well as if SOD or the TMM is restarted.
Impact:
None.
Recommended Action:
None.
010c0050 : Sod requests links down
Location:
/var/log/ltm
Conditions:
This is an information message that is logged during the shutdown of the SOD daemon. It indicates that the links to Bcm56xxd and lacpd have been marked down.
Example:
Nov 11 07:29:03 lead notice sod[6214]: 010c0050:5: Sod requests links down.
Impact:
None.
Recommended Action:
None.
010c0052 : Standby for traffic group %s
Location:
This log only appears in /var/log/ltm. It does not appear on the Console or the GUI.
Conditions:
When a traffic group transitions to the standby state, this log message is logged by the system.
For example when a device is released from the forced offline state; the sequence of logs includes the following:
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c0044:5: Command: release offline all GUI.
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c0054:5: Offline for traffic group TG2.
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c0054:5: Offline for traffic group traffic-group-1.
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c003e:5: Offline
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c006d:5: Leaving Offline for Standby for dbvar is redundant.
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c0052:5: Standby for traffic group TG2.
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c0052:5: Standby for traffic group traffic-group-1.
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c0018:5: Standby
Oct 11 13:30:04 BIGIP-2 info sod[28395]: 010c0096:6: Next active for traffic group traffic-group-1.
Oct 11 13:30:04 BIGIP-2 info sod[28395]: 010c0096:6: Next active for traffic group TG2.
Impact:
None. This is a notification of what is happening with the traffic-group in the device.
Recommended Action:
None.
010c0054 : Offline for traffic group %s.
Location:
/var/log/ltm. Neither the Console nor the GUI show it.
Conditions:
When a traffic-group is about to become active or standby, it starts with the transitional state of offline, which 0is when the log appears. For example the following sequence of logs appear when the device is booting up:
Oct 11 13:00:46 BIGIP-2 notice sod[5403]: 010c0057:5: Activating traffic group TG2.
Oct 11 13:00:46 BIGIP-2 notice sod[5403]: 010c0054:5: Offline for traffic group TG2.
Oct 11 13:00:46 BIGIP-2 notice sod[5403]: 010c0057:5: Activating traffic group traffic-group-1.
Oct 11 13:00:46 BIGIP-2 notice sod[5403]: 010c0054:5: Offline for traffic group traffic-group-1.
This could also be a result of initial configuration or releasing a device from a forced offline state. A common log sequence will look like this:
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c0044:5: Command: release offline all GUI.
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c0054:5: Offline for traffic group TG2.
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c0054:5: Offline for traffic group traffic-group-1.
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c003e:5: Offline
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c006d:5: Leaving Offline for Standby for dbvar is redundant.
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c0052:5: Standby for traffic group TG2.
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c0052:5: Standby for traffic group traffic-group-1.
Oct 11 13:30:04 BIGIP-2 notice sod[28395]: 010c0018:5: Standby
Oct 11 13:30:04 BIGIP-2 info sod[28395]: 010c0096:6: Next active for traffic group traffic-group-1.
Oct 11 13:30:04 BIGIP-2 info sod[28395]: 010c0096:6: Next active for traffic group TG2.
Impact:
None. This is a notification of what is happening with the traffic-group in the device.
Recommended Action:
None.
010c0055 : Forced offline for traffic group %s.
Location:
/var/log/ltm
Conditions:
This log message occurs if the SOD detects that a traffic group has been forced offline by the admin.
Impact:
The log (level Notice) is generated by SOD after a traffic group has been forced offline and is no longer accessible to the user.
Recommended Action:
The admin has forced the specified traffic group offline and the user must use other traffic groups.
010c0056 : Deactivating traffic group %s
Location:
/var/log/ltm. Neither the Console nor the GUI provide it.
Conditions:
SOD has to reactivate the traffic groups in the device when certain configuration changes occur on the box, specially at boot time. This requires a deactivate/activate sequence, and, when the deactivate occurs, this log appears.
Impact:
None. This is a notification of what is happening with the traffic group on the device.
Recommended Action:
None.
010c0057 : Activating traffic group %s
Location:
/var/log/ltm. Neither the Console nor the GUI provide it.
Conditions:
SOD has to activate the traffic groups in the device when certain configuration changes occur on the box, specially at boot time. This requires a deactivate/activate sequence, and, when the activate occurs, this log appears.
Impact:
None. This is a notification of what is happening with the traffic group on the device.
Recommended Action:
None.
010c005a : Dropping a failover packet that is too small (%u)
Location:
/var/log/ltm
Conditions:
This message indicates that a message was received by SOD on one of its failover listening addresses, but the message was not big enough to be a valid failover packet.
Impact:
Messages that arrive at the failover listening addresses that are too small to be valid are dropped. There is no other effect on system behavior beyond this.
Recommended Action:
If failover messages are not being received from another device in the failover-sync group, and these messages are present in the log, it may indicate an issue with the SOD daemon on the other device. Restarting SOD on the other device may clear the issue. If not, then support will need to be contacted.
Spurious occurrences of this log without other system issue, are not a cause for concern.
010c005b : Dropping a packet that is not a failover packet.
Location:
/var/log/ltm
Conditions:
This log message occurs if the SOD process receives a packet that is not a failover packet.
Impact:
The log (level Notice) is generated when an unknown packet is received by the SOD process and the packet is dropped.
Recommended Action:
None.
010c005e : Waiting for mcpd to reach phase base, current phase is %s
Location:
/var/log/ltm
Neither the GUI nor the console should display it.
Conditions:
This log appears when the switch over (failover) daemon is trying to establish a connection with MCP (configuration daemon). It reports the current MCPD phase in its boot-up sequence.
Impact:
None. This log is informing that MCPD is not ready yet to take any connection.
Recommended Action:
None.
010c005f : Mcpd has reached phase base, current phase is %s
Location:
/var/log/ltm
Conditions:
This is an informational message that SOD has connected to MCPD, and MCPD has reached a state where SOD can continue starting up. This is logged whenever SOD starts up and connected to MCPD and MCPD reaches at least the base phase.
Example:
Nov 11 07:35:24 lead notice sod[6502]: 010c005f:5: Mcpd has reached phase base, current phase is running.
If the following message is seen, and the "MCPD has reached phase base" is not seen afterwards, it may indicate an issue with MCPD.
Nov 11 07:35:00 localhost notice sod[6502]: 010c005e:5: Waiting for mcpd to reach phase base, current phase is platform.
Impact:
None.
Recommended Action:
None.
010c0063 : Waiting for Mcpd without a response. Try again...
Location:
/var/log/ltm
Conditions:
This log message occurs if the SOD process has not established a connection with the MCPD process.
Impact:
The log (level Notice) is generated once during every connection attempt to the MCPD process until a successful connection is established. The SOD process will not operate until this connection is established.
Recommended Action:
Investigate the state of the MCPD process and possibly try a process restart.
010c006a : Configuration CRC values disagree amongst peers. Suggest configsync peers.
Location:
/var/log/ltm
Observed in the UI Device Management "Details" status display.
In the "show cm traffic-group" command.
Conditions:
Configuration relevant to network failover is not in-sync between devices in a failover device group. This message can appear briefly when traffic-group configuration has changed but configsync has not yet completed to the other devices.
Impact:
Network failover calculations might not be correct, resulting in inconsistent (or no) selection of a next-active device, and failover to an unintended location.
Recommended Action:
Enable automatic sync for the failover device group (preferred).
Manually sync the new configuration to the device group.
010c006b : Configuration CRC values agree amongst peers
Location:
/var/log/ltm
There are other indications of configuration being out of sync between devices in the GUI and command line, but the setting and clearing of these indications are unrelated to this log message.
Conditions:
When traffic-group state from other devices is processed, this log appears if the devices in the failover-group did not previously have their configurations in sync.
Oct 13 06:59:37 BIGIP-1 notice sod[6779]: 010c006b:5: Configuration CRC values agree amongst peers.
Impact:
None: Indicates that configurations are now in-sync between devices in the failover-group.
Recommended Action:
None.
010c006c : proc stat: [0] %s
Location:
/var/log/ltm. Neither the console nor the GUI provide it.
Conditions:
SOD has a list of processes it monitors. When any of the processes goes away, this log message appears.
An example of relevant logs when tmm is restarted with bigstart restart follows:
Oct 12 10:23:14 BIGIP-2 warning sod[28395]: 01140029:4: HA proc_running tmm fails action is go offline and down links.
Oct 12 10:23:14 BIGIP-2 notice sod[28395]: 010c0050:5: Sod requests links down.
...
Oct 12 10:23:21 BIGIP-2 notice sod[28395]: 01140045:5: HA reports tmm NOT ready.
Oct 12 10:23:22 BIGIP-2 notice sod[28395]: 010c006c:5: proc stat: [0] pid:28459 comm:(tmm.0) state:S utime:93 stime:103 cutime:1 cstime:10 starttime:7709594 vsize:6928031744 rss:18225 wchan:18446744073709551615 blkio_ticks:9 [-1] pid:1887 comm:(tmm.0) state:S utime:158666 stime:34358 cutime:0 cstime:13 starttime:85235 vsize:6932230144 rss:19317 wchan:18446744073709551615 blkio_ticks:7 [-2] pid:1887 comm:(tmm.0) state:S utime:158655 stime:34355 cutime:0 cstime:13 starttime:85235 vsize:6932230144 rss:19317 wchan:18446744073709551615 blkio_ticks:7 .
Oct 12 10:23:24 BIGIP-2 notice sod[28395]: 01140030:5: HA proc_running tmm is now responding.
...
Oct 12 10:23:31 BIGIP-2 notice sod[28395]: 01140044:5: HA reports tmm ready.
Oct 12 10:23:31 BIGIP-2 notice sod[28395]: 010c0049:5: Tmm ready - links up.
Oct 12 10:23:34 BIGIP-2 notice sod[28395]: 010c006c:5: proc stat: [0] pid:27987 comm:(bigd) state:S utime:6 stime:2 cutime:13 cstime:5 starttime:7709247 vsize:47583232 rss:6415 wchan:18446744071579502277 blkio_ticks:1 [-1] pid:3648 comm:(bigd) state:S utime:1920 stime:604 cutime:12 cstime:10 starttime:176428 vsize:50548736 rss:6472 wchan:18446744071581059260 blkio_ticks:15 [-2] pid:3648 comm:(bigd) state:S utime:1920 stime:604 cutime:12 cstime:10 starttime:176428 vsize:50548736 rss:6472 wchan:18446744071581059260 blkio_ticks:15 .
The log will appear when the process goes away, and when it comes back.
Impact:
None. This log on itself only provides a notification that SOD detected a process going away. The rest of the logs relevant to the process that went away should give more information of what went wrong.
Recommended Action:
None.
010c006d : %s.
Location:
/var/log/ltm
Conditions:
Reports information about the system. It can change from release to release because it is a complete free-form log, and has no rules of what information it can convey.
Some examples are:
"Leaving Offline for Active for dbvar not redundant (tmm ready)"
"Leaving Offline for Standby for dbvar not redundant (tmm not ready)"
"Leaving Offline for Active for mate is active"
"Leaving Offline for Standby for dbvar is redundant"
"Leaving Standby for Offline for ha table offline_cond"
"Leaving Standby for Active for dbvar not redundant (tmm ready)"
"No peer active but stay put for longer."
"Leaving Standby for Active (best ha score)"
"Leaving Standby for Active (mate ha score)"
Impact:
None.
Recommended Action:
None.
010c006e : All devices in traffic group %s %s have a HA group.
Location:
/var/log/ltm
Conditions:
Two different cases for this log message.
Case 1: 'All devices in traffic group %s now have a HA group'
This case indicates that HA group is configured correctly on all devices for a traffic group.
Case 2: 'All devices in traffic group %s should have a HA group'
This case indicates that HA group is not configured correctly on all devices for a traffic group.
Impact:
Case 1 is informational, indicating that HA group is configured correctly.
Case 2 is an error condition, indicating that the configuration of HA group is not configured correctly on one or more of the devices. HA group will not operate correctly for this traffic group.
Recommended Action:
Fix the configuration of the HA group in the traffic group on all devices for case 2 log message.
010c0076 : Exceeded mcp recv soft limit: %d. Succeeded after %d messages.
Location:
/var/log/ltm
Conditions:
When SOD is starting, it establishes a connection with MCP. If initialization exceeds the expected number of messages, it will log this notification with the original expected limit and the actual number.
Impact:
None.
Recommended Action:
None.
010c0077 : Listening for unicast failover packets on address %s port %d.
Location:
/var/log/ltm
Conditions:
This message indicates that SOD is listening on the specified address and port for unicast network failover packets. It is logged when SOD starts up and begins listening for failover packets. It is also logged when a new unicast failover address is configured while SOD is running.
Impact:
None.
Recommended Action:
None.
010c007b : Deleted unicast failover address %s port %d for device %s.
Location:
/var/log/ltm
Conditions:
This log message appears when a unicast ip address is deleted on a device by the admin.
Impact:
This log message is an informational message that shows that a unicast address was deleted on a device.
Recommended Action:
None.
010c007e : Not receiving status updates from peer device %s (Disconnected).
Location:
/var/log/ltm
Conditions:
This message is logged on a peer device in the failover-sync group when it does not receive any network failover packets for the network timeout. This timeout defaults to 3 seconds.
Impact:
The device mentioned in the log message is marked as offline by the device logging the message, and is not eligible to be the next failover device.
Recommended Action:
The state of the device that was disconnected should be checked on the reported device. It could be a networking issue, a hardware issue, or an environmental issue.
Once the issue is corrected the device will start sending network failover packets and will be marked online again.
010c0082 : Sorted Load-Aware failover %s.
Location:
/var/log/ltm
Conditions:
This log message occurs if there is a change by the SOD process in the use of the internal Sorted Load-Aware failover algorithm. The message will appear if it was previously disabled and is now enabled, or if it was previously enabled and is now disabled.
Impact:
The log (level Informational) is generated once during a change in the internal algorithm state. The Load Aware algorithm is more efficient when Sorted is used, but it can only be used if all devices are capable of running it. The user cannot configure this or determine if it is in use solely by means of this log.
Recommended Action:
None.
010c0083 : No failover status messages received for %s seconds, from device %s (%s).
Location:
/var/log/ltm
Conditions:
This log message occurs when the SOD process has not received a failover packet from a peer connection during the configured timeout interval.
Impact:
The log (level Warning) is generated after an expected failover packet is not received before the configured timeout interval. This indicates that the peer is no longer sending failover updates to the SOD process, possibly indicating that the peer has become busy or is offline.
Recommended Action:
Investigate the state of the peer connection.
010c0084 : Failover status message received after %s second gap, from device %s (%s).
Location:
/var/log/ltm
Conditions:
This log message occurs when the SOD process receives a failover packet from a peer connection that it marked as no longer sending failover updates.
Impact:
This log (level Warning) is generated by a peer, which is no longer sending failover packets to the SOD process during the expected timeout interval, that has resumed sending packets. The time between packets (in seconds) is displayed.
Recommended Action:
This message is informational.
010c0085 : First failover status message received from device %s (%s).
Location:
/var/log/ltm
Conditions:
This log message occurs if the SOD process has received a message for the first time on a peer connection.
Impact:
The log (level Informational) is generated after the SOD process receives a message for the first time on a new peer connection. This log provides information to the user about this peer connection.
Recommended Action:
None.
010c0089 : Invalid go standby command. %s is not a valid traffic-group or device.
Location:
/var/log/ltm
Conditions:
If an administrator runs the cmd_sod command directly from the Linux shell, and provides an invalid argument.
Impact:
No failover.
Recommended Action:
Use the correct device or traffic group name.
010c008a : Invalid go standby command. %s is not a valid device.
Location:
/var/log/ltm
Conditions:
If an administrator runs the cmd_sod command directly from the Linux shell, and provides an invalid argument.
Impact:
No failover.
Recommended Action:
Use the correct device name.
010c008b : Unable to send to unreachable unicast address %s port %d.
Location:
/var/log/ltm
Conditions:
The failover daemon (sod) periodically sends UDP packets to other devices in the Device Service Cluster. A packet could not be sent, usually because the current routing table indicates there is no route to the destination device.
Impact:
When sod is unable to transmit Network Failover packets, other devices in the Device Service Cluster may conclude that the device is inoperative, and take over service.
Recommended Action:
Restore network connectivity between the devices.
010c008c : Previously unreachable unicast address %s port %d is now reachable.
Location:
/var/log/ltm
Conditions:
Clears the prior error condition has cleared.
Impact:
Restores normal transmission of network failover packets.
Recommended Action:
None.
010c0098 : Multicast socket connect failure: %s.
Location:
/var/log/ltm
Conditions:
An invalid multicast address is configured as the multicast-ip for a device.
Impact:
Multicast failover packets will not work on the multicast interface, thus reducing the reliability of operation in an HA cluster.
Recommended Action:
Configure a valid multicast address on all devices in the HA cluster. IPv4 multicast addresses must be in the 224.0.0.0/4 subnet and IPv6 multicast addresses must use the ff00:/8 prefix.
010c0099 : Connected to multicast group %s port %d on interface %s.
Location:
/var/log/ltm
Conditions:
The SOD high-availability (HA) daemon is able to successfully connect to the HA multicast interface configured in the device configuration.
Impact:
None.
Recommended Action:
None.
010c009a : Disconnected from multicast group %s port %d on interface %s.
Location:
/var/log/ltm
Conditions:
The SOD high-availability (HA) daemon disconnects from the multicast HA group. This can be due to the shutdown of the SOD HA daemon, or it can happen when the multicast-ip is changed.
Impact:
None.
Recommended Action:
None.
010c009b : Availability log %s failed '%s'.
Location:
/var/log/ltm
Conditions:
A read or write action to the availability log failed (for example, /var/log/availability.0).
Impact:
Gaps can be present in the availability log that might cause inaccurate system availability metrics or might prevent the display of availability metrics.
Recommended Action:
Remove the availability log or reset the stats. This will resolve the issue if you are unable to display availability metrics.
010c009c : Timer interval set to %u.%06us (was %u.%06u).
Location:
/var/log/ltm
Conditions:
The failover daemon has changed the polling interval.
Impact:
None. The system is acting normally.
Recommended Action:
None.
010c009d : Poll interval %dms, estimated %d packets/sec.
Location:
/var/log/ltm
Conditions:
Failover device group configuration has caused the failover daemon to recalculate the estimated update rate.
Impact:
None. The system is operating normally.
Recommended Action:
None.
010c009e : Config crc changed: old 0x%x new 0x%x.
Location:
/var/log/ltm
Conditions:
The high-availability configuration digest CRC has been changed due to a configuration change that affects the selection of the next-active location for traffic groups in a device service cluster.
Impact:
The message allows the user to determine which device in the device service cluster "differs" when the devices do not agree on the configuration. In this case where different nodes have different CRC values, default rules are followed.
Recommended Action:
None.
010d0005 : Chassis fan %d: status (%d) is bad
Location:
/var/log/ltm
Conditions:
A sensor determined that the fan speed is zero (0) RPM, indicating the chassis fan is not rotating.
Impact:
One or more faulty fans reduces the cooling capacity of the system, which can result in overheating issues. This log entry triggers the alarm LED to turn red and display an alert on the LCD.
Recommended Action:
Check for obstructions blocking the fan blades. Replace the fan tray for the faulty fan.
010d0006 : Chassis power supply %d has experienced an issue. Status is as follows: %s
Location:
/var/log/ltm
Appears in GUI, console, and LCD.
Conditions:
A system power supply has failed.
Impact:
In a redundant power supply system, only one power supply will be operational.
Recommended Action:
Replace the failed power supply. If the message persists, file a support ticket.
010d0009 : %s: voltage (%d) is too high
Location:
/var/log/ltm
Conditions:
A voltage sensor reading exceeded the operational limits.
Impact:
Continued operation during these conditions can produce component failure or unexpected behavior. This log triggers a red LED alarm and displays an alert on the LCD.
Recommended Action:
Contact support for resolution.
010d0010 : %s: fan speed (%d) is too low
Location:
/var/log/ltm
Appears in GUI, console, and LCD.
Conditions:
A system fan failed to operate at the minimum speed.
Impact:
Depending on the failed fan, the system could power off if chassis or CPU temperatures exceed maximum operating temperatures.
Recommended Action:
Determine the failed fan by typing 'system_check -d' at the command line. File a support ticket to diagnose and resolve this hardware problem.
010d0017 : %s: milli-voltage (%d) is too low
Location:
/var/log/ltm
Appears in GUI, console, and LCD.
Conditions:
Loss of power, or input power is out of recommended range.
Impact:
If a loss of power caused the condition, power redundancy is compromised.
If a loss of power did not cause the condition, indeterminate behavior can result.
Recommended Action:
Verify power is applied to unit.
Verify that the power is the correct input range.
Replace PSU associated with the alarm.
010e0001 : Cannot communicate with MCPD server
Location:
/var/log/ltm
Conditions:
This can be a result of BIG-IP device being very busy. The SNMP agent is unable to communicate with MCPd and thus logs this message. This situation can recover if BIG-IP device becomes less busy. Internally the SNMP requests come into the agent via the MCPd daemon. Responses back to the requester traverse the path back by means of the MCPd as well.
Impact:
All user requests either by means of the cli or the access to SNMP agents will not be honored. The SNMP data will not be retrieved as the interface to the SNMP daemon is down.
Recommended Action:
As a last option, reboot the BIG-IP device.
010e0002 : Established new connection to MCPD server
Location:
/var/log/ltm
Conditions:
This message occurs when a connection or new connection is established with the MCPD server. This message is internal to our software and is only an informational message. MCPD is the master control process daemon which has a number of connections to other processes of which one is the snmpd. When it establishes a communication channel to the snmpd process this message is printed in the log.
Impact:
An internal informational message is logged each time the mcpd communication channel is established with the snmpd.
Recommended Action:
None.
010e0004 : MCPD query response exceeding %d seconds
Location:
/var/log/ltm
Conditions:
This error message occurs when the MCPd response time is very slow. The SNMP subagent is encountering long timeouts while communicating with MCPd. The system may be very busy.
Impact:
The SNMP request fails.
Recommended Action:
One can retry the request. Also, it is worth executing an unrelated tmsh command to see if the same slow response times are seen. Wait to see if it is temporary slowdown of MCPd. Stop any of the SNMP queries that are currently running. As a last option, restart the BIG-IP device.
01100002 : alertd is going down
Location:
/var/log/ltm
Conditions:
BIG-IP device is restarting, or just the alertd daemon is stopping or restarting.
Impact:
None, informational only.
Recommended Action:
None.
01100017 : Email action is failed for toaddress %s
Location:
/var/log/ltm
LCD
SNMP Trap
Conditions:
Email notification for system alert failed to be sent.
Impact:
No additional impact to the system.
Recommended Action:
Recommendation is to review SOL3667 at AskF5 where email notification configuration is described. Make sure there are valid "To" and "From" addresses configured.
01100042 : Failed with MCPD at: %s (%s)
Location:
/var/log/ltm
Conditions:
The alertd daemon has encountered an inter-process communication error with the mcpd daemon. When this happens, there is likely a problem with mcpd either being down or too busy.
Impact:
If the error is simply "Socket read", and non-repeating, it was likely a single case of congestion and should not have long-term impact.
Most of the other errors such as "Connect", "Subscribe", "MCP msg receive", "Socket/pipe select", "Socket error event", "syslog pipe error event", or "errdefs scoket error event" indicate a failure for the alertd daemon to initialize properly. In this situation, alert generation and their associated SNMP traps are likely to be inoperational.
Recommended Action:
Issue a 'bigstart status alertd mcpd' from the CLI. If either process is not in 'run' state, or if the associated log messages are persisting, try issuing a 'bigstart restart <alertd|mcpd>' depending on whether one is malfunctioning, or perhaps both.
01100043 : logcheck Notice: %s %d
Location:
/var/log/ltm
Conditions:
1. "Disconnect mcpd". alertd disconnects from mcpd when alertd is exiting, due to a restart or the BIG-IP system shutting down.
2. "Receive alert msg from diskmonitor". alertd received a message from the disk monitoring subsystem, leading to a check for log rotation.
3. "logrotate triggered by large log <name_of_log_file> of size <size> KB -"Available disk space is <size> KB". Occurs when logrotate is running to compress logs.
Impact:
None. This is not an error condition, but normal operation. logrotate runs periodically to compress logs.
Recommended Action:
None.
01100048 : "Log disk usage still higher than %d%% after logrotate and %d times log deletion"
Location:
/var/log/ltm
Conditions:
Disk usage has surpassed the percentage threshold specified by the DB variable "logcheck.warnthres", whose default value is set at 80%. This warning is given after the system has already tried to compress or delete older log files over a number of iterations indicated in the message (default is 24 iterations).
Impact:
Disk space is running low, which could impact the system's ability to perform logging functions, receive new software for upgrades, or perform any other function requiring additional disk space.
Recommended Action:
1. Delete any unnecessary large files on the system or older logs.
Use "du" to find where the largest files are located:
du -a | sort -n -r
Inspect /shared/images for any unwanted ISO files.
Inspect /var/log for any undesirable large files.
2. Modify the "logcheck.warnthres" value if user believes that the disk usage threshold for the warning is too low.
modify sys db logcheck.warnthres Value
Values:
[enter integer value min:0 max:100]
3. Consider adding additional storage capacity.
01100049 : logcheck Info: %s %d
Location:
/var/log/ltm
Conditions:
Informational messages that indicate DB variable values, free disk space in /var/log, and notifications that old compressed files are being deleted to free up space.
Impact:
Informational, but in some cases, might indicate a low amount of disk space free and deletion of the oldest compressed log archives in /var/log/ltm.
Recommended Action:
If message indicates deletion of old, compressed files, try deleting any unnecessary files that may be contributing to low amount of free disk space.
01100053 : %s
Location:
/var/log/ltm
Conditions:
This message occurs when a system administrator uses the command "lcdwarn -p emergency MESSAGE". In this case, the BIG-IP system logs the string "MESSAGE" and displays "MESSAGE" on the LCD pane, under priority "emergency".
Impact:
The Alert LED on the front panel of the box blinks red.
Recommended Action:
Use the command "lcdwarn -c emergency" to clear all messages of priority "emergency" from the LCD panel.
01100054 : %s
Location:
/var/log/ltm
Conditions:
This message occurs when a system administrator uses the command "lcdwarn -p critical MESSAGE". In this case, the BIG-IP system logs the string "MESSAGE" and displays "MESSAGE" on the LCD pane, under priority "critical".
Impact:
The Alert LED on the front panel of the box is solid red unless a higher priority message is also being displayed.
Recommended Action:
Run the command "lcdwarn -c critical" to clear all messages of priority "critical" from the LCD panel.
01100055 : %s
Location:
/var/log/ltm
Conditions:
This string is generated when an administrator uses the command "lcdwarn -p alert MESSAGE". In this case, the BIG-IP system logs the string "MESSAGE" and displays "MESSAGE" on the LCD panel under priority "alert".
Impact:
The Alert LED on the front panel of the box will be solid red unless a higher priority message is also being displayed.
Recommended Action:
Run 'lcdwarn -c alert' to clear all messages of priority 'alert' from the LCD panel.
01100056 : %s
Location:
/var/log/ltm
Conditions:
This string is generated when an administrator uses the command "lcdwarn -p error MESSAGE". In this case, the BIG-IP system logs the string "MESSAGE" and displays "MESSAGE" on the LCD panel under priority "error".
Impact:
The Alert LED on the front panel of the box will blink yellow unless a higher priority message is also being displayed.
Recommended Action:
Run 'lcdwarn -c error' to clear all messages of priority 'error' from the LCD panel.
01100057 : %s
Location:
/var/log/ltm
Conditions:
This string is generated when an administrator uses the command "lcdwarn -p warning MESSAGE". In this case, the BIG-IP system logs the string "MESSAGE" and displays "MESSAGE" on the LCD panel under priority "warning".
Impact:
The Alert LED on the front panel of the box will be solid yellow unless a higher priority message is also being displayed.
Recommended Action:
Run 'lcdwarn -c warning' to clear all messages of priority 'warning' from the LCD panel.
01100058 : %s
Location:
/var/log/ltm
Conditions:
An administrator has run the command 'lcdwarn -p info MESSAGE'. MESSAGE is the text string logged and displayed on the LCD panel under priority 'info'.
Impact:
None.
Recommended Action:
Run the command 'lcdwarn -c info' to clear all messages of priority 'info' from the LCD panel.
01100059 : Found db_name %s without value - reset to default %s.
Location:
/var/log/ltm
Conditions:
The user issues the command 'tmsh modify reset-to-default' against sys db variables that are in use by the alertd daemon.
Impact:
None.
Recommended Action:
None.
01100060 : trap string (%s) count (%d) (%s)");
Location:
/var/log/ltm file (debug level)
Conditions:
alertd-level debugging is enabled to test trap suppression and tune some DB variables.
Impact:
The system reports on the trap suppression handling of a message. It reports the OID and the message string being tracked, plus the count of times the strings have been seen within the suppression interval and whether the trap is being suppressed. For debugging only, this enables field support and administrators to decide if the values of their DB variables for trap suppression are correct for their environment.
Recommended Action:
If traps are either not being suppressed when you would like them to be or being suppressed when they don't want them to be, use the data reported in the log messages to adjust the values configured for the DB variables "snmp.BIG-IPtraps.suppress.interval" and "snmp.BIG-IPtraps.suppress.count".
01100061 : clear suppression map (count %d)");
Location:
/var/log/ltm file (debug log level)
Conditions:
alertd-level debugging is enabled to report when the map used to track trap suppression has been cleared.
Impact:
The map is cleared when trap suppression in disabled (that is, the db variable "snmp.bigiptraps.suppression.interval" is set to 0) or when the map has grown to 1K entries.
Recommended Action:
None.
01110001 : Error running %s
Location:
This message will be generated in the LTM log.
Conditions:
These messages will only be generated when configuration is being synchronized between a pair of devices running a version of TMOS prior to 11.0. In 11.0, a new synchronization system was introduced and this message is longer be generated.
Impact:
The sync request fails, and the other device still has the configuration prior to 11.0.
Recommended Action:
Determine why the sync failed. Disk usage on the local or peer device might be a factor, as well as differences in the base configuration on the peer device, which can cause validation errors. Those errors will be found in the peer device's logs.
01110034 : The configuration for running config-sync is incorrect.
Location:
/var/log/ltm
Conditions:
This message is only generated on versions of TMOS prior to 11.0. Any of the following conditions will cause it to be generated:
- The device is not part of a redundant pair (see DB variable failover.isredundant).
- The device does not have a peer IP configured (either configsync.peeripaddr or statemirror.peeripaddr is acceptable).
- This device is unable to reach the other device over iControl SOAP to determine that it is configured as part of a redundant pair.
- This device has the same hostname configured as the other device, or cannot reach the other device to obtain its hostname (see DB variable hostname).
Impact:
Sync is not possible until all of the above conditions are resolved.
Recommended Action:
Inspect the values of the DB variables and check for iControl connectivity between the two devices.
0114001a : HA stale %s pid %d detected.
Location:
/var/log/ltm
Conditions:
When daemons restarted, stale data was detected in the internal HA table.
Impact:
This is an informational message, indicating that stale data was detected and ignored.
Recommended Action:
None.
01140029 : HA %s %s fails action is %s.
Location:
/var/log/ltm
Conditions:
This message occurs when a component detects an HA failure condition, and requests the system to take corrective action.
The first field is the feature type, and the second field is the component name. The list of configured HA features is available through the 'show sys ha-status' command.
Impact:
The impact depends upon what corrective action is configured for the specified component.
Recommended Action:
Correct the issue that caused the component to fail.
0114002a : HA %s %s created.
Location:
/var/log/ltm
Conditions:
The creation of a new HA table entry. The first parameter is the HA table feature name, the second is the component that the feature was created for. The "show sys ha-status" command lists all the current HA Table entries.
Impact:
None. This is a debug-level informational message and is only observed if the component logging level changes from the default to 'debug'.
Recommended Action:
None.
0114002b : HA %s %s enabled.
Location:
/var/log/ltm
Conditions:
An HA Table entry is enabled for failure monitoring. The first parameter is the HA table feature name, the second is the component that the feature was created for. The "show sys ha-status" command lists all the current HA Table entries.
Impact:
None.
Recommended Action:
None.
0114002c : HA %s %s disabled.
Location:
/var/log/ltm
Conditions:
Failure monitoring is disabled for an HA Table entry. The first parameter is the HA table feature name, the second is the component that the feature was created for. The "show sys ha-status" command lists all the current HA table entries.
Impact:
Failure of the designated component will not be detected.
Recommended Action:
None.
01140030 : HA %s %s is now responding
Location:
/var/log/ltm
Conditions:
An HA error condition no longer exists for the specified feature.
Impact:
The system may be able to exit the failure condition required by the HA error condition.
Recommended Action:
None.
01140043 : Ha feature %s reboot requested
Location:
/var/log/ltm
Conditions:
This message is issued when an HA system detects that a reboot should be performed. The most common occurrences are during administrator-requested reboots or a change of boot location:
Ha feature reboot_request_t reboot requested.
Ha feature software_update reboot requested.
Other components may be administratively configured to cause a reboot on failure.
Impact:
The device reboots.
Recommended Action:
If the reboot was unintentional, identify the failing component indicated by the 'feature', and other preceding log message that references this 'feature', and determine why that component failed. If a reboot is not an appropriate action for that component failure, reconfigure it for a different action.
01140044 : HA reports tmm ready
Location:
/var/log/ltm
Conditions:
The TMM is ready to process traffic.
Impact:
It's not an error.
Recommended Action:
None.
01140045 : HA reports tmm NOT ready
Location:
/var/log/ltm
Conditions:
It occurs any time that the tmm starts (or restarts), during the period from startup until when the TMM completes initialization.
Impact:
No traffic is processed until the TMM is ready.
Recommended Action:
Wait for the TMM to become ready.
01140100 : Overdog daemon startup
Location:
/var/log/ltm
Conditions:
The system is starting up and the HA watchdog is now active.
Impact:
The system will now respond to HA error conditions.
Recommended Action:
None.
01140101 : Overdog daemon shutdown
Location:
/var/log/ltm
Conditions:
The system watchdog daemon (overdog) has been shut down, typically because the system is shutting down or rebooting.
Impact:
Watchdog monitoring is no longer active.
Recommended Action:
Wait for the system to finish shutting down.
01140102 : Overdog daemon requests reboot
Location:
/var/log/ltm
Conditions:
The overdog daemon has detected that a subsystem has requested an HA action of "reboot", and is initiating the operation.
Impact:
The system will reboot.
Recommended Action:
None.
01140103 : Watchdog touch enabled with %d seconds
Location:
/var/log/ltm
Conditions:
This message is issued when the system watchdog process (overdog) initiates the hardware watchdog feature.
Impact:
If the system becomes non-responsive, it will automatically reboot.
Recommended Action:
None.
01140104 : Watchdog touch disabled
Location:
/var/log/ltm
Conditions:
This message is issued when the hardware watchdog process (overdog) disarms the hardware watchdog and stops periodic updates. This occurs automatically when the system is already rebooting, or when the administrator disables the hardware watchdog by setting the watchdog.state DB variable to "disable".
Impact:
The hardware watchdog will not automatically reboot the system.
Recommended Action:
Enable the watchdog function by setting the watchdog.state DB variable to "enable".
01140106 : Overdog daemon calling bigstart restart
Location:
/var/log/ltm
console
Conditions:
An HA Table failover action that specifies 'restart-all' has been triggered.
Impact:
All traffic groups will fail over to a peer device, and all local services are restarted.
Recommended Action:
None.