topic Re: PA-VM sysd_construct_sync_importer in General Topics

PA-VM sysd_construct_sync_importer

Gabeeh — Tue, 03 Jan 2023 20:05:21 GMT

We got a customer that runs into this issue recently, it's a known issue (not public) for versions 11.0.0, 10.2.3, 10.2.2-h1 (and also to us 10.2.3-h2, 10.2.2-2).

When you run into this, means that there's a hardware issue, please go to TAC in order to find the root cause.

VM-series fails to boot on Hyper V with older Intel Xeon CPUs.

This is happening with Hyper V.

The solutions that we used to fix it are two:

Revert to the previous version in maintenance mode:
1. Enter maintenance mode
2. Disk image
3. Revert to the previous
Deactivate the Vm and deploy a new one, in this case they use credits VM:
1. Deactivate the VM license: Deactivate License (Software NGFW Credits) (paloaltonetworks.com)
2. Deploy a new one.

I post this since it happened to me twice and couldn't find more info, or more relevant info regarding it.

Best wishes!

Re: PA-VM sysd_construct_sync_importer

kiwi — Wed, 04 Jan 2023 14:19:40 GMT

Hi @Gabeeh ,

Thanks for sharing this experience with the world ! I'm sure it'll be very useful for whoever runs into the same issue !

Kind regards,

-Kiwi

Re: PA-VM sysd_construct_sync_importer

JeffH-SecBBQ — Tue, 07 Feb 2023 18:48:25 GMT

Hello,

I am running into the same issue with the PAN-OS VM-Series Base Image for PAN-OS 11.0.

It may very well be that this issue is related to the CPU(s) powering the hypervisor and not that the issue is specific to Hyper-V.

In my case, the CPU is indeed an older Intel Xeon processor, but I am running on VMware ESXi - not Microsoft Hyper-V.

VMware ESXi 6.7.0 Update 2 (Build 13981272)

ProLiant DL360 G7

12 CPUs x Intel(R) Xeon(R) CPU E5649 @ 2.53GHz

@Gabeeh I tried following your recommendation. I booted the VM into the maint partition and tried performing a factory reset. This is a net-new VM-Series build.

I've also tried upgrading an existing VM-Series running 10.2 to version 11.0 and get the same error message as soon as I try to login as user 'admin' from the console.

I've included a copy of the log from VMware ESXi in the event it can provide anything useful in support of the known issue.

The network interface seems to have initialized and I can ping it, but neither SSH nor HTTP/HTTPS are listening, so I am unable to login via the network.

Do you happen to know if this is an issue that will be resolved? Or will the older CPU simply no longer be supported?

Thanks in advance!

Re: PA-VM sysd_construct_sync_importer

efurlan — Mon, 06 Mar 2023 11:07:42 GMT

Hi all,

we had the same problem 3 time with a Panorama Management only, the enviroment is Vmware enviroment with 128Gb RAM

I think is a memory leak

Re: PA-VM sysd_construct_sync_importer

JeffH-SecBBQ — Mon, 13 Mar 2023 14:50:01 GMT

Memory leaks typically happen over a period of time. This issue occurs as soon as PAN-OS starts.

The original post, as well as mine, have the older Xeon CPU in common. What hardware are you running on?

I'd think if this were a memory leak, it would be something that would affect many more customers. But just purely speculative.

It would be nice to get some additional feedback from Palo Alto Networks.I think they've been tracking this as an issue but I'm not sure if it's been resolved yet - or if it will be. If it's related to CPU architecture, it may have been a conscious decision to not support aging hardware.

Re: PA-VM sysd_construct_sync_importer

PavelK — Fri, 31 Mar 2023 02:13:38 GMT

Today, PAN-OS 10.2.4 and 11.0.1 were released and this issue is addressed in these versions:

PAN-206069
Fixed an issue where the firewall was unable to boot up on older Intel CPUs.

Kind Regards
Pavel

Re: PA-VM sysd_construct_sync_importer

tamilvanan — Tue, 26 Dec 2023 13:31:34 GMT

Hi,

Please refer the below document, it might help:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMQxCAO&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Regards,

Tamil

Re: PA-VM sysd_construct_sync_importer

adityasharma.pk2004 — Sat, 28 Dec 2024 09:53:46 GMT

same issue with me

Re: PA-VM sysd_construct_sync_importer

adityasharma.pk2004 — Sat, 28 Dec 2024 09:59:18 GMT

facing same issue; unable to login; sysd_construct_sync_importer error four time while login;
i configured vm and firewall with 18 gb of ram and 4 processors and processor type:- Ryzen 5 7000HS processor

Re: PA-VM sysd_construct_sync_importer

JayGolf — Fri, 03 Jan 2025 00:22:20 GMT

Hi @AdityaSharma.pk2004 ,

Have you tried following the guidance above?

Re: PA-VM sysd_construct_sync_importer

ErenYeager — Sun, 05 Jan 2025 17:08:17 GMT

Hi,

Did you find a fix ?

Re: PA-VM sysd_construct_sync_importer

AndyOReilly — Wed, 22 Jan 2025 13:25:09 GMT

Might be unrelated but I'm currently deploying some VM-Palos (11.1.4-h1) in Google Cloud Platform (Intel Cascade Lake).

They were working fine, 3rd party asked me to swap the Management interface from eth0 to eth1, ran the command, restarted and they were ok.

Rolled the change back, restarted them and when they came back up I was getting the same error as the original poster when trying to login (via console)

Stopped the VM from the GCP console, started the VM and it started working again