This article describes why the log messages may report that changes on a filter have failed due to a lack of memory space.

When attempting to save changes to an already existing filter, the save may fail and report the following log message:

/kernel - - - DFW_PFE: add/change for filter x failed due to lack of memory space

where "x" is the name of the filter.

The failure and log message result when the filter is too large and is using up all allocated filter memory. This issue is often seen when AIS commit scripts are running and attempting to commit the filter again, and there is not enough memory for the new commit because the current filter configuration is using all the memory.

There are two ways to resolve this problem:

1. Decrease the size of the filter by creating several smaller filters.

2. Increase the amount of memory for firewall filters by taking the memory from the memory designated for the routing table.

Note: For information on how to repartition memory, see the following Juniper document: Configuring the Junos OS to Allocate More Memory for Routing Tables, Firewall Filters, and Layer 3 VPN Labels .