SSL Visibility Host Categorization file descriptor leak mitigation
search cancel

SSL Visibility Host Categorization file descriptor leak mitigation

book

Article ID: 271263

calendar_today

Updated On:

Products

SV-1800 SV-2800 SV-3800 SV-800 SV-S550

Issue/Introduction

The purpose of this Critical Alert is to inform of a potential problem that has been recently identified with SSL Visibility with BCIS Host Categorization.  Please read the information provided below and follow the instructions to avoid being impacted by this problem.

Environment

SSL Visibility software versions 4.5.10.1, 4.5.11.1 and 5.4.2.1 and up, running with Host Categorization are potentially impacted. 

If your SSL Visibility is not categorizing flows using a Host Categorization subscription, it will not be impacted.

Cause

When SSLV is configured with Host Categorization subscription there is a small file descriptor leak which can cause following errors after 4-5 months.  When the issue starts to impact you will see the following logging in the syslog file:

 

ssldata[xxx]: [E] RPC connection terminated:X_RPC [0x0000000180110001;code:1;sub:1] Internal error

ssldata[xxx]: [E] RPC connection terminated:X_RPC [0x0f00000e80110004;code:4;sub:251658254] Bad address

 

This logging and the file descriptor leak will eventually leading to a crash, which can cause a temporary outage depending on configuration.

Resolution

If SSLV is running software versions mentioned above and is configured to utilize Host Categorization subscription and is approaching uptime of 4 months or above.

•    Reboot SSLV during maintenance window.
•    Upgrade to SSLV software 4.5.10.3 or 4.5.11.2 or 5.4.3.1

If you are upgrading to version 4.5.10.3 or 4.5.11.2 or 5.4.3.1 please check the article: Upgrade to SSL Visibility 4.5.10.3, 4.5.11.2 and 5.4.3.1 may result in Host Categorization updates failing.