cannot edit or create new Citrix WAF Signatures

[amr fawzy1709157741]

When I create a new signature from the default signatures or try to edit an existing one, I get the error " Unable to complete System file update request ". It was working yesterday normally, no changes made to the ADC

[Johannes Norz]

https://support.citrix.com/article/CTX463665/ is wrong, the problem still exists, or came back with latest updates.

[amr fawzy1709157741]

[Johannes Norz]

Just had the same problem.

 

Problem description:

 

If I create new signatures, cloning the existing Snort signatures (sigs version 100), I get an error "File too large [File size: 2.036754 MB. Exceeding by bytes: 38539]"

I had been using NetScaler 13.1, Build 37.38

 

Same happens, if I want to change existing patterns. That's what I find in the logs (doesn't help much):

Quote

Jan 16 17:53:37 <local0.info> 10.1.40.119  01/16/2023:13:53:37 GMT NS_test_innsbruck 0-PPE-0 : default GUI CMD_EXECUTED 398 0 :  User nsroot - Remote_ip 192.168.229.1 - Command "show appfw signatures" - Status "Success"
Jan 16 17:53:37 <local0.info> NS_test_innsbruck syslogd: last message repeated 1 times
Jan 16 17:53:37 <local0.info> 10.1.40.119  01/16/2023:13:53:37 GMT NS_test_innsbruck 0-PPE-0 : default GUI CMD_EXECUTED 399 0 :  User nsroot - Remote_ip 192.168.229.1 - Command "show appfw profile" - Status "Success"
Jan 16 17:53:37 <local0.info> NS_test_innsbruck syslogd: last message repeated 1 times
Jan 16 17:53:41 <local0.info> 10.1.40.119  01/16/2023:13:53:41 GMT NS_test_innsbruck 0-PPE-0 : default GUI CMD_EXECUTED 400 0 :  User nsroot - Remote_ip 192.168.229.1 - Command "show appfw signatures" - Status "Success"
Jan 16 17:53:41 <local0.info> NS_test_innsbruck syslogd: last message repeated 1 times
Jan 16 17:53:41 <local0.info> 10.1.40.119  01/16/2023:13:53:41 GMT NS_test_innsbruck 0-PPE-0 : default GUI CMD_EXECUTED 401 0 :  User nsroot - Remote_ip 192.168.229.1 - Command "show appfw profile" - Status "Success"
Jan 16 17:53:41 <local0.info> NS_test_innsbruck syslogd: last message repeated 1 times
Jan 16 17:53:41 <local0.info> 10.1.40.119  01/16/2023:13:53:41 GMT NS_test_innsbruck 0-PPE-0 : default CLI CMD_EXECUTED 402 0 :  User nsroot - Remote_ip 192.168.229.1 - Command "sftp-server" - Status "Success"

 

I tried the same with 13.0 build 85.15, no problem! Same with 13.0 89.7. Has to be a bug in version 13.1