topic Re: Management CPU is 100% in General Topics

Management CPU is 100%

ajay — Tue, 09 Apr 2013 10:58:29 GMT

Hi Guys,

We are having an issue with the Palo Alto 2050 running OS 5.0.2. Earlier it happens when we do a commit or generating some reports. Then we cleared the all logs and update to 5.0.2 and now the Management CPU is always 100% even though we didn't do anything. Is this is a bug in 5.0.2 and does the next version 5.0.3 will fix this. Please help me on this as we are really worried about this.

Regards

Paul Mathew

Network Engineer

American School of Dubai

Re: Management CPU is 100%

Retired Member — Tue, 09 Apr 2013 11:08:13 GMT

Yes it is fixed.Upgrade to 5.0.3 or 5.0.4

Re: Management CPU is 100%

ajay — Tue, 09 Apr 2013 11:24:59 GMT

Thanks man will try this out.

Re: Management CPU is 100%

gswcowboy — Tue, 09 Apr 2013 13:23:33 GMT

That's correct. Bug ID 47948: User-ID process constantly running on very high CPU utilization reaching over 100% thus causing high MP CPU. Fixed in 5.0.3

Re: Management CPU is 100%

ericgearhart — Tue, 09 Apr 2013 15:47:49 GMT

Fixed in 4.1.12 as well as far as I'm aware for those still on that code base... still waiting on its release though.

Re: Management CPU is 100%

gswcowboy — Tue, 09 Apr 2013 15:50:40 GMT

Hello,

Please request 4.1.11-h1 as this hotfix is available for the bug in question.

Re: Management CPU is 100%

ajay — Wed, 10 Apr 2013 03:45:57 GMT

Rkalugdan you are right the 5.0.3 has a fix and that upgrade solve the issue. Thanks for all your help on this.

Re: Management CPU is 100%

Colp — Thu, 02 May 2013 18:40:57 GMT

I'm not meaning to bash, but my 2050s have been running slow ever since moving off of 3.1.8 . I'm on 4.1.11 at this moment (the move to 4.0 was a disaster), but all upgrades between have been getting slower and slower performance. Logging in takes minutes, switching tabs take just as long, forget committing unless you have 20 minutes to spare. My question is are these "upgrades and updates" being thoroughly tested before being pushed out? I really do mean this because it seems that actualy user functionality has dramatically decreased even though we have a ton of new "features". Look at how many more updates and hot fixes come out compared to the older versions. Both of my 2050s work at the speed of boat anchors and it has my bosses furious. I really like the palo alto products and what they do for us, I wouldn't want another solution, I just feel like these updates aren't being thoroughly tested on the devices they are being used for. I feel that for the $$ these boxes cost they would be a bit more useable.

Re: Management CPU is 100%

darren_g — Fri, 03 May 2013 03:27:04 GMT

Dude, you're preaching to the converted here - several others have asked the same question, and we all agree - the QA process PAN has been following in recent releases sucks.

I agree with you - the 3.1.x releases were way faster and had less bugs than the 4.x, but what can you do?

Re: Management CPU is 100%

ericgearhart — Fri, 03 May 2013 13:51:12 GMT

... vote with your budget... change firewall vendors. Sad but true. Where I currently work, the Palo Alto QA missteps we have seen are causing us to seriously reevaluate our firewall strategy.

Re: Management CPU is 100%

ericgearhart — Fri, 03 May 2013 13:53:40 GMT

rk - we're waiting for the DHCP NACK fix to be backported before we upgrade to 4.1.11 or 4.1.12... we're waiting on 4.1.13 (assuming the DHCP fix makes it in) before we do the upgrade.

Re: Management CPU is 100%

Colp — Fri, 03 May 2013 14:01:16 GMT

I upgraded our failover 2050 to 4.1.12 this morning and the update appears to have solved the "sitting at 100%" problem. My management cpu is bouncing between 60 and 65% which is still high in my opinion, especially just for logging in, but I have noticed improved navigation speed.

Re: Management CPU is 100%

Jamiefitzgerald — Fri, 03 May 2013 23:40:14 GMT

Colp,

I am very sorry to hear that you have had issues with the 2000 series management plane performance. We have definitely grown our feature set and as we grow our feature set we have grown our QA and testing infrastructure. We are continually working to improve our testing methodology and process.

That said, unfortunately, you currently have the our slowest management plane firewalls. The 2000 series firewalls were designed years ago and we have heard the complaint about management performance. We have been working hard on the software side to improve the commit time and navigation of the user interface. The 5.0 release had many of these improvements, but to see major differences the hardware needed to get some horsepower. The 3000 series mid range firewalls have approximately 400% more RAM and CPU performance as the 2000. We are seeing commit times go down from many minutes to less than a minute. The overall management experience is much improved.

I know that not everyone can upgrade the hardware because of budgets, but before you change vendors, please know that we are listening and working on solutions to your issues. I continue to put a major effort into improving and optimizing the software. However, if it is a possible for your organization, please evaluate one of our 3000 series. I think you will find that we are making strides on the management performance side. Thank you

Re: Management CPU is 100%

mikand — Sat, 04 May 2013 22:20:54 GMT

Also check with the supplier if a discount is possible for replacement of your 2000 boxes?

That is so you wont have to pay the full price of a new pair of 3000 boxes if you return the 2000 boxes at the same time.

The 500 series has a ram upgrade available (which lowered the commit times with about 30% or so according to posts in this forum) which unfortunately doesnt seem to be possible for the 2000 series.

Re: Management CPU is 100%

darren_g — Mon, 06 May 2013 00:02:43 GMT

egearhart wrote:

... vote with your budget... change firewall vendors. Sad but true. Where I currently work, the Palo Alto QA missteps we have seen are causing us to seriously reevaluate our firewall strategy.

Trouble with that is finding another device which is as effective - the PAN filtering model is kinda like crack - one you've had it, it's damn hard to break the habit! 🙂

Re: Management CPU is 100%

ericgearhart — Mon, 06 May 2013 14:38:54 GMT

I hear you, and honestly I want PA to succeed. I like the "story" of the little guy with the game-changing and revolutionary ideas winning (as the oldest example i have of that, I got on board with Linux around 1998, when I was like... 15).

I just want them to improve the QA process, test these new features, and ultimately not make me look foolish for 'cheerleading' for them at work.

Re: Management CPU is 100%

darren_g — Mon, 13 May 2013 02:51:20 GMT

egearhart wrote:

Youngster. 🙂

egearhart wrote:

I just want them to improve the QA process, test these new features, and ultimately not make me look foolish for 'cheerleading' for them at work.

I'd like not to have to keep covering my arse by slipping upgrades in at 4 am in the hope that I can figure out if they've gone pear-shaped before everyone else gets here at 8.

Re: Management CPU is 100%

Colp — Mon, 13 May 2013 13:14:28 GMT

At the time of purchase (years ago), the 2050s weren't the slowest devices and the salesman & engineers that evaluated our operations deemed the 2000 series to be adequate to our needs. It appears as though the newer software (I'm on 4.1.12 now) , was designed beyond the limits of the 2000 series because the older versions (3.1.x) worked better for the hardware. The feature set and abilities of the newer software is better and improved, and I greatly appreciate that fact, but it doesnt run fast on the older boxes like mine.

We are considering new series boxes and we will research other solutions as well, but I don't like the "fix it by investing large sums of money in a new mid grade box" mind set. Will the newer 3000 series be treated the same way in a couple of years? Our budget is not unlimited, we cannot chunk our old boxes and buy new ones every 2 or 3 years. I feel it would be a better design to be able to upgrade some of the hardware in the device, the 500 series can and I would've appreciated that functionality in my device too.

Re: Management CPU is 100%

ericgearhart — Mon, 13 May 2013 13:17:16 GMT

Your response reflects 100% of what I was thinking when I saw the "just go buy 3000 series appliances!" response...

Re: Management CPU is 100%

ericgearhart — Mon, 13 May 2013 13:44:15 GMT

darren.gibbs wrote:

I'd like not to have to keep covering my arse by slipping upgrades in at 4 am in the hope that I can figure out if they've gone pear-shaped before everyone else gets here at 8.

Yes, that too ^^