topic Re: GlobalProtect appweb3 exhaust Mgmt CPU % due to large amount of users in GlobalProtect Discussions

GlobalProtect appweb3 exhaust Mgmt CPU % due to large amount of users

Wenwei_Y — Thu, 16 Jun 2022 03:06:36 GMT

Hi Everyone,

I experienced issue with GlobalProtect. At the start of the day, appweb3 will spike up abnormally to like 95%.

From the traffic logs we noticed a lot different user trying to access GP. However the timing was exact the same for all the users and it stretches across many pages.

From KB below I understand that the appweb3 (sslvpn) process supports a maximum rate of 100 requests/second. And the large amount of users caused appweb3 to exhaust the Mgmt CPU %.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sY2iCAE&lang=en_US%E2%80%A9

However, I could not find out the reason why is there such amount of user logging in at the same time and even exact to second.

Those users are legitimate users and of different IP addresses.

This issue occurred after I patched from PanOS 9.1.13 h-3 to 9.1.14.

Re: GlobalProtect appweb3 exhaust Mgmt CPU % due to large amount of users

BPry — Sat, 18 Jun 2022 05:23:42 GMT

@Wenwei_Y,

I've seen a few reports that could point towards a bug in 9.1.14 for the sslvpn process. I'd file a TAC case and provide your logs so that it can be analyzed and reported if it's an actual process bug.

Re: GlobalProtect appweb3 exhaust Mgmt CPU % due to large amount of users

Wenwei_Y — Sun, 19 Jun 2022 10:38:11 GMT

Hi @BPry ,

Thank you for the response. May I know are there any official article/report regarding this bug? Are the reports you had seen available for us?