topic Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform. in General Topics

New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

idelconsulting — Sat, 20 Jul 2024 15:49:45 GMT

Dear all,

since a couple of days I'm getting alerts like:

Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform. Please consider removing unused configuration

I removed all old auto saved configs after upgrades, and the config size looks ok:
> show management-server last-committed config-size
392261 bytes

What seems to be strange is the size of the candidate configs;

> show management-server candidate config-size
20213190 bytes

Apparently there is no way to delete these, except may be TAC getting root access.

Did anyone else see this and found a solution?

Regards

Andreas

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

BPry — Tue, 23 Jul 2024 22:01:54 GMT

@idelconsulting,

This isn't saved configurations that you may have on the device, it's regarding the actual size of the configuration file being utilized on the device. Assuming that you utilize Panorama, make sure you aren't pushing unused objects since that's a very quick way to run into this issue. You have to have a relatively large configuration to be at 19MB, and the quickest way to get there is having Panorama pushing unused objects.

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

idelconsulting — Wed, 24 Jul 2024 11:57:13 GMT

I'm not sing Panorama.

The firewall is locally managed.

And according to the CLI these are all candidate contigs, but no pending commit.

Regards,

Andreas

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

M-WBERB — Thu, 25 Jul 2024 08:24:04 GMT

Hi Andreas,

we're having the same issue with a vm platform (not panorama managed).

Disk space especially root partition is around 30% space left.

I just opened a case with pan.

The Supporter mentioned that a fix will be provided in 11.1.3.

For a workaround you could exclude the alert. From the logs setting > system, you can try to negate keywords. For example, "(severity eq critical) and not (description contains 'Configuration size')".

Max

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

idelconsulting — Thu, 25 Jul 2024 10:33:03 GMT

Hi Max,

I'm running 11.1.3-h2 and the issue is not fixed yet.

Regards,

Andreas

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

EdmarFrancis — Mon, 12 Aug 2024 04:55:08 GMT

Hello @M-WBERB , hope you are doing well. Did TAC provide a PAN-ID for the issue?

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

M-WBERB — Mon, 19 Aug 2024 07:39:07 GMT

Hi @EdmarFrancis unfortunately not.

TAC only mentioned that this is known internally but sadly was not published as a known Issue with an Issue ID.

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

JFonner — Wed, 02 Oct 2024 16:18:34 GMT

Anyone found an Issue ID for this or seeing this problem in 11.1.4?

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

S.Hanna — Fri, 04 Oct 2024 19:19:22 GMT

I was on 11.1.2-h3 and was seeing this alert. I updated to 11.1.4.-h1 last night but still see a giant config file.

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

RussellYan — Mon, 07 Oct 2024 22:12:00 GMT

Same. I upgraded to 11.1.4h1 and opened a tac case, they just replied w/ same which is you must delete policies, nats, url lists or unused items to get below threshold. he said the max is 23MB and said its bigger on newer models. i check data specs and no mention of configuration size and when you google configuration size limit on palo, the response is 23MB for ALL NGFWs. You would think with all these new OS upgrades, they would have increased the size of the configuration space. 23MB ? smh.

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

SilverMacaw — Tue, 08 Oct 2024 05:58:06 GMT

Yeah, it’s pretty frustrating. You’d expect with all the advancements in the OS, they'd allow for larger config sizes, especially considering how complex setups can get these days. 23MB feels super limiting, and it's not like the hardware can't handle it, especially with newer models. I mean, deleting policies or NATs just to stay under a cap seems like an outdated solution. Hopefully, they address this soon in future updates.

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

RussellYan — Tue, 08 Oct 2024 13:45:32 GMT

just found out from SE, they advise against upgrading to 11.1.4h1 for PA850 due to the size of 11.x OS , it causes a performance hit when it approaches the config size limit since 11.x is bigger. they recommend staying at 10.2 /10.1 series

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

HolgerKrause — Tue, 19 Nov 2024 16:05:19 GMT

Hi,

I update to 11.1.5-h1 and the issue is still there. Or isn't it an issue at all, only a annoing errror message? Has anyone fixed it?

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

robertsmyth — Mon, 02 Dec 2024 11:32:10 GMT

I'm on 11.1.5 and getting this error message on my PA-820.... very frustrating, I've cleared out any unused configuration items and its still the same, I dont believe that our config is particularly complicated either. Naturally I'm not willing to remove any ones that are in operation so what are we to do? I don't see that we should downgrade to V10.2 again utter nonsense so a workaround is needed...

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

akbar.raoufi — Thu, 05 Dec 2024 17:05:53 GMT

Upgraded to 11.1.4-h7 on PA-820 and have this issue, not good.

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

DZamudio — Thu, 05 Dec 2024 18:45:36 GMT

Having this issue too for a while and just overnight the pre-defined config grew by 1MB. Based on my investigation the culprit is the Device Dictionary, they keep added more devices/items which is making the Config grow. We don't even have IOT License on the firewall. Very concerning since it threw us closer to the Max.

We have already opened several cases and nothing from TAC on a solution, they threw us in different scenarios just to come back and say there isn't much we can do. Upgrading doesn't leave much of a good taste, since what was recommended to us was a 1410 which its Max config size is 35MB, while yes it bigger but if we are sititng at around 22MB right now.... what doesn't guarantee that in a few years we'll be in the same boat? TAC also can't tell if more pre-defined config will be pushed and that we won't reach the limit on the suggested firewall.

It is also expensive, even with credits from our existing subscription, the total for the new 1410 with all same licensing puts us at twice higher price than going with an alternate vendor for Firewalls.

This is madness....

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

idelconsulting — Sun, 08 Dec 2024 00:27:27 GMT

11.1.4-h7 shows now as a preferred release for the PA-820.

So how can they say one should downgrade to 10.x?

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

DZamudio — Mon, 09 Dec 2024 15:24:03 GMT

Hello,

So, I just reached out and opened a new case. We are on 11.1.4-h7 on our PA-850 and the TAC we got assigned reviewed in detail our ticket/issue and returned with a command we had to run on our firewall which expanded the maximum size, he explained there was a fix that was done and this command is needed to expand the maximum config size, otherwise if it is not done and left as is, then you can have the problems of slowness/crashes.

I've asked for more detail and if this was ever made publicly/article where they mention this fix & the command that needs to be done to expand it.

They also confirmed with this, we shouldn't have any further issues & even compared to other cases & they can confirm it has been fixed.

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

HolgerKrause — Mon, 09 Dec 2024 15:53:43 GMT

Hi,
and thanks for sharing. We only got the information that this is a known issue but only internally and therefore it does not have an issue ID.

Right now we are at 21MB of 23MB. Hope this will have a good end. Creating a filter supressing the error messages can't be the solution.

Re: New periodic alert: Configuration size 19MB is above 80% of the maximum recommended configuration size 23MB for the platform.

idelconsulting — Sat, 14 Dec 2024 01:05:07 GMT

Hello,

I also opened a new case and referenced this discussion.

Initially I got the standard answer but after referencing the post from DZamudio they came back with the command to run in order to expand the allowed config size.

I also asked them if I can post the command here but didn't receive an answer.

I then asked them to update this discussion with the solution.

I was told they will do that but didn't say when.

Regards,

Andreas