topic Re: Systemlog? Firewall restarted for some reason? in General Topics

Systemlog? Firewall restarted for some reason?

karl_wiren — Tue, 22 May 2012 07:40:58 GMT

Does some one know how to show systemlog? My firewall just restarted daytime for no reason my clients dropped their internal network and were not avaible to surf the internet for some minutes, it affected 5.000~ users :'(

I need to know what happend.. Is there any way to see the system log?

Re: Systemlog? Firewall restarted for some reason?

karl_wiren — Tue, 22 May 2012 07:42:00 GMT

I can only see the system log at the Dashboard, but i whould like a longer one more informative

Found it Monitor > Logs > System

Re: Systemlog? Firewall restarted for some reason?

karl_wiren — Tue, 22 May 2012 07:51:13 GMT

( description contains 'infra-group: restarts exhausted, rebooting system' )

What do this mean? restarts exhausted, rebooting system

( description contains 'Management server started. Running version 4.1.4' ) Started? I have not tunrned it off?

( description contains 'Dataplane is now up' ) Same here i did not turn it off?

What is happening to my firewall, why is it behaving so weird?

Re: Systemlog? Firewall restarted for some reason?

mikand — Tue, 22 May 2012 08:23:07 GMT

If im not mistaken PA has added autorestart of failed services at the mgmt-plane.

One such case (as example) was the failing SSL-termination in 2xxx models. With the autorestart of hung services the box could continue operate (with little loss of functions (only time between the process hung and that the process had been restarted again), compared to if the SSL-termination halts and you find out about this hours later).

I think that if a specific service have been forced to restart several times the PANOS will restart the whole mgmtplane instead, but this shouldnt affect the dataplane (the whole idea of separate mgmt- and dataplanes, except for the stuff thats handled by the mgmtplane like updating userid relations and issue the ssl-termination certs (which also is different in different models where this is taken care of)).

Re: Systemlog? Firewall restarted for some reason?

mikand — Tue, 22 May 2012 08:27:28 GMT

I hope any of these can help:

'infra-group: restarts exhausted, rebooting system' and Firewall REBOOTS random
https://live.paloaltonetworks.com/message/14634#14634

PAN-OS Software Buffer Leak, Issue ID 36829
https://live.paloaltonetworks.com/docs/DOC-2847

Critical Issues to be Addressed in Future PAN-OS Releases
https://live.paloaltonetworks.com/docs/DOC-1982

So this can happen either if the swap is runned out or by buffer leaks.