topic How to Fix High CPU Usage on Palo Alto PAN-2020 in General Topics

How to Fix High CPU Usage on Palo Alto PAN-2020

support.ocd — Thu, 06 Feb 2014 10:28:15 GMT

Hello,

We use this FW as proxy, we have PaloAlto1 and PaloAlto2 it's cluster how can I troubleshoot this issue.

Thank's you

Best regards,

Re: How to Fix High CPU Usage on Palo Alto PAN-2020

pulukas — Thu, 06 Feb 2014 12:50:57 GMT

Start by looking at the cpu resources following this tech document. This will let you know what process is at issue.

How to Interpret: show system resources

Re: How to Fix High CPU Usage on Palo Alto PAN-2020

support.ocd — Thu, 06 Feb 2014 13:14:47 GMT

Hi Steven,

Thank you for your reply, so i need to launch this commande in order to see what process causing the problem.

Best regards,

Re: How to Fix High CPU Usage on Palo Alto PAN-2020

HULK — Thu, 06 Feb 2014 17:35:25 GMT

First of all, we need to identify which CPU is high, MP CPU (management-plane) or DP CPU (data-plane)...?

The above documents will help you for MP-CPU. From the GUI of the PAN firewall, if you go to Dashboard >> @ bottom left corner, it will show you the CPU utilization.

Example:

NOTE: To understand DP CPU, you can apply below mentioned CLI commands.

CLI> show running resource-monitor

CLI> show session info

CLI> show session meter

CLI> Debug data-plane pool statistics

CLI>> show counter global filter delta yes >>>>>>>> Run this command 10 times with a 5 sec interval.

Hope this helps.

Thanks

Re: How to Fix High CPU Usage on Palo Alto PAN-2020

darren_g — Fri, 07 Feb 2014 00:15:10 GMT

What PanOS version are you running, and which CPU is under the load?

If it's the management CPU, and the spike is every 5 minutes or so, there's nothing you can do about it. Version 6 is supposed to help in reducing these spikes, but it's caused by the log index process, which kicks off every 5 minutes, and will normally kick your management CPU up to 60-70% for a couple of minutes.

As I said, V6 is supposed to fix this - haven't installed V6 yet, so I can't comment one way or another if it does.