topic Re: Dataplane PA2050 restart with no reasons. why? in General Topics

Dataplane PA2050 restart with no reasons. why?

soporteseguridad — Fri, 31 May 2013 06:08:56 GMT

Hi, i hope someone can help me about this error.

My primary (active) Palo Alto suddenly restarted yesterday with no reasons, thanks god HA worked and we are actually working with the secondary PA. I have checked the monitor system log and i cant find the reasons why my PA was restarted.

I attached a screenshot with the monitor system log. Thanks a lot

PA2050

Software version 5.0.3

Re: Dataplane PA2050 restart with no reasons. why?

soporteseguridad — Fri, 31 May 2013 06:16:40 GMT

I attach

show log system severity equal critical 2013/05/30 13:29:22 critical ha	connect 0 HA Group 1: HA1 connection down
2013/05/30 13:29:22 critical ha	connect 0 HA Group 1: All HA1 connections down
2013/05/30 13:29:53 critical ha	datapla 0 HA Group 1: Dataplane is down
2013/05/30 13:29:53 critical ha	state-c 0 HA Group 1: Moved from state Active to state Non-Functional
2013/05/30 13:29:54 critical ha	ha2-lin 0 HA2 link down
2013/05/30 13:29:54 critical ha	ha2-lin 0 All HA2 links down
2013/05/30 13:29:54 critical general	general 0 The dataplane is restarting.
2013/05/30 13:29:57 critical ha	ha1-lin 0 HA1 link down
2013/05/30 13:29:57 critical ha	ha1-lin 0 All HA1 links down
2013/05/30 13:30:00 critical general	general 0 Chassis Master Alarm: HA-event
2013/05/30 13:36:45 critical general	general 0 Chassis Master Alarm: Cleared

Re: Dataplane PA2050 restart with no reasons. why?

Retired Member — Fri, 31 May 2013 06:30:19 GMT

can you type

show system files

and look if there is a crash information

Re: Dataplane PA2050 restart with no reasons. why?

soporteseguridad — Fri, 31 May 2013 06:58:32 GMT

admin@FW1(passive)> show system files

/var/cores/:

total 36M

-rw-r--r-- 1 root root 15M Apr 2 13:16 useridd_5.0.3_0.tar.gz

drwxrwxrwx 2 root root 4.0K Apr 25 16:21 crashinfo

-rw-r--r-- 1 root root 21M Apr 25 16:32 websrvr_5.0.3_0.tar.gz

/var/cores/crashinfo:

total 32K

-rw-rw-rw- 1 root root 18K Apr 2 13:02 useridd_5.0.3_0.info

-rw-rw-rw- 1 root root 9.9K Apr 25 16:21 websrvr_5.0.3_0.info

/opt/dpfs/var/cores/:

total 5.4M

drwxrwxrwx 2 root root 4.0K May 30 13:29 old

-rw-rw-rw- 1 root root 6.2M May 30 13:30 core.926

-rw-rw-rw- 1 root root 6.2M May 30 13:30 core.936

drwxrwxrwx 2 root root 4.0K May 30 13:31 crashinfo

-rw-r--r-- 1 root root 322K May 30 13:45 flow_mgmt_5.0.3_0.tar.gz

-rw-r--r-- 1 root root 1.5M May 30 13:45 pktproc_n_log_5.0.3_0.tar.gz

-rw-r--r-- 1 root root 365K May 30 13:45 mprelay_5.0.3_0.tar.gz

/opt/dpfs/var/cores/old:

total 2.3M

-rw-rw-rw- 1 root root 5.2M May 30 13:29 core.918

/opt/dpfs/var/cores/crashinfo:

total 28K

-rw-r--r-- 1 root root 24 May 30 13:30 pktproc_n_log_5.0.3_0.pcap

-rw-r--r-- 1 root root 24 May 30 13:30 flow_mgmt_5.0.3_0.pcap

-rw-rw-rw- 1 root root 3.6K May 30 13:31 mprelay_5.0.3_0.info

-rw-rw-rw- 1 root root 7.8K May 30 13:31 pktproc_n_log_5.0.3_0.info

-rw-rw-rw- 1 root root 5.0K May 30 13:32 flow_mgmt_5.0.3_0.info

Re: Dataplane PA2050 restart with no reasons. why?

Retired Member — Fri, 31 May 2013 07:05:02 GMT

You have to open a case for that.Crashes not related to that time but I advise you to upgrade software 5.0.5 since there are many bug which is fixed related to restart problems.

Re: Dataplane PA2050 restart with no reasons. why?

gswcowboy — Fri, 31 May 2013 14:28:08 GMT

Those core files for the DP processes would provide insight as to what may have caused the restart. We would need to analyze them and attempt to cross refer to any known bugs fixed in 5.0.4 or 5.0.5 respectively. Best recourse to help determine root cause would be to open a case with Support or your Reseller.