SSL Visibility Host Categorization file descriptor leak mitigation
Article ID: 271263
Updated On:
Products
Issue/Introduction
The purpose of this Critical Alert is to inform of a potential problem that has been recently identified with SSL Visibility with BCIS Host Categorization. Please read the information provided below and follow the instructions to avoid being impacted by this problem.
Environment
SSL Visibility software versions 4.5.10.1, 4.5.11.1 and 5.4.2.1 and up, running with Host Categorization are potentially impacted.
If your SSL Visibility is not categorizing flows using a Host Categorization subscription, it will not be impacted.
Cause
When SSLV is configured with Host Categorization subscription there is a small file descriptor leak which can cause following errors after 4-5 months. When the issue starts to impact you will see the following logging in the syslog file:
ssldata[xxx]: [E] RPC connection terminated:X_RPC [0x0000000180110001;code:1;sub:1] Internal error
ssldata[xxx]: [E] RPC connection terminated:X_RPC [0x0f00000e80110004;code:4;sub:251658254] Bad address
This logging and the file descriptor leak will eventually leading to a crash, which can cause a temporary outage depending on configuration.
Resolution
If SSLV is running software versions mentioned above and is configured to utilize Host Categorization subscription and is approaching uptime of 4 months or above.
• Reboot SSLV during maintenance window.
• Upgrade to SSLV software 4.5.10.3 or 4.5.11.2 or 5.4.3.1
If you are upgrading to version 4.5.10.3 or 4.5.11.2 or 5.4.3.1 please check the article: Upgrade to SSL Visibility 4.5.10.3, 4.5.11.2 and 5.4.3.1 may result in Host Categorization updates failing.
Feedback
