This message was deleted.

Looks like a hang of NSPPE triggered it, I would get the support involved but it seems 13.1 is not as stable as 13.0. I'm planning to upgrade to 13.1 this week as I was told MPX 9120 only support 13.1 and 13.0 is out of support now 😕

Eirik: Just making sure, which version of 13.1 is this? If it's not updated (which I hope is not the case), the exploit can crash NSPPE.

13.1-49.13 We patched quickly and no indicators of compromise. The latest HA par which failed over did not even have AAA/Gateway enabled.

Hmm, that's good, well, ish. How often does it RECOVER? Could it be your logs filling up /var/*log/ ?

Not that often really. On this particular HA pair 3 times since upgrading to 13.1 in may. Amount of logs looks normal. Plenty of space available on /var. This looks similar: https://community.netscaler.com/s/question/0D58b0000Ah4SHcCQM/since-update-to-version-131-we-see-the-following-message-several-times-see-details Support are looking at the logs now.

Ahh, okay, it definitely seemed to happen more often.. I hope support can find something, random failovers are no fun to track down, could be the smallest network change that sets it off, too.

Indeed. Thanks for responding!

I saw a case where the NetScaler hung because the authentication policies were not all updated to the new syntax. The conversion tool did not suggest updates to the authentication policies. Make sure all of them are in the new syntax or removed.