topic Re: Long commit times when changing DNS settings in General Topics

Long commit times when changing DNS settings

s0lselcia — Mon, 16 Dec 2024 17:00:11 GMT

On an HA pair of PA-460, the commit time is usually around 60 seconds, when changing the DNS settings to something that is not reachable, the commit time changes to 10 minutes+. I've tried replacing the primary but the issue is the same. When I looked at the device server logs there was a continual message with the number incrementing:

debug: pan_tdb_threat_id_hash_find(pan_tcomp_tdb.c:4391): threat_id_hash tid 94952 not found, is it ignored?

and

debug: pan_profile_comp_add_tahash(pan_profile_comp.c:3344): mlav profile_tahsh_insert with tid 52121, appid 0 action 0x300c

This seems to be going through all the threat IDs and maybe this is the reason that the commit has slowed down? If so is there a setting to disable these checks? or speed up the commit time?

Re: Long commit times when changing DNS settings

BPry — Tue, 17 Dec 2024 21:23:02 GMT

@s0lselcia,

I'm not aware of any way to really modify how a commit processes without utilizing a commit force, which I don't believe would address this issue at all. Is there a reason why you're changing your DNS settings to servers that aren't accessible?

Re: Long commit times when changing DNS settings

s0lselcia — Wed, 18 Dec 2024 08:56:46 GMT

Thanks for your response. I believe the cause is the EDLs. it's for when the internal network is not reachable, and external internet is not accessible.

Re: Long commit times when changing DNS settings

OtakarKlier — Thu, 19 Dec 2024 19:03:08 GMT

Hello,

Do you have a lot of objects that are DNS based? Also in the logs, do you have the check box for resolve DNS checked?

Just thinking out loud.

Regards,