Error: "Search system is down" on the Virtual Service WAF Tab

Products

• VMware Avi Load Balancer

Issue/Introduction

When attempting to navigate to the WAF tab within a Virtual Service configuration, you may encounter an error message preventing access to the view - "Search system is down, Try again later".

This typically happens when viewing WAF statistics for the past 6 hours or longer.

Example screenshot:

Environment

Affects Avi version 30.2.x

Cause

This issue is caused due to the indexer process running out of allocated memory while attempting to process data for the Virtual Service WAF tab.

This issue specifically occurs when a Virtual Service generates a high volume of logs.

The underlying search engine may be unable to ingest and handle the scale of logs being generated.

Resolution

This error is most likely to occur when viewing WAF statistics over longer durations, such as the past 6 hours. As a workaround, reducing the duration to "Past 30 minutes" should help the WAF statistics to load.

There is no permanent fix for this issue as the WAF tab for Virtual Services has been deprecated starting with version 31.1.1.