topic Re: Higher Management CPU post upgrade to 7.0.4 in General Topics

Higher Management CPU post upgrade to 7.0.4

Brandon_Wertz — Tue, 19 Jan 2016 15:15:16 GMT

I've got a 5060 A/P pair that was running 6.1.4.

We are/were doing :

SSL forward Intercept

SSL Mirror

7 AD Group Mappings

Transparent Captive Portal

4 UIA

Pre-upgrade our MGMT CPU was around 20%. Post upgrade to 7.0.4 we're 70%. There have been no reports of issues by users and I haven't noticed any impacts from response in the UI.

My question was has anyone else noticed an increase in the MGMT CPU? I'm guessing the increase has come from the redesign of ACC with the new ACE functionality, but haven't really investigated, yet.

Re: Higher Management CPU post upgrade to 7.0.4

BenjAudy.MTL — Tue, 19 Jan 2016 15:48:04 GMT

Hi,

Which process exactly is using that much CPU time ("show system resources follow" command in CLI)?

Benjamin

Re: Higher Management CPU post upgrade to 7.0.4

Brandon_Wertz — Tue, 19 Jan 2016 16:29:06 GMT

varrcvr

logrcvr

mgmtsrvr

Are the 3 ones hopping back and forth for top consuming CPU.

varrcvr using sometimes 120%+

Re: Higher Management CPU post upgrade to 7.0.4

syadav — Tue, 19 Jan 2016 17:05:58 GMT

Hi Brandon,

varrcvr is usually responsible for URL logging and pcaps, do you have any pcaps enabled on the firewall by any chance ?

Also check for any core files :

> show system files

If the mgmt CPU hovers above 70% all the time, I would suggest opening a case with Technical support to investigate further.

Re: Higher Management CPU post upgrade to 7.0.4

Retired Member — Tue, 19 Jan 2016 17:49:01 GMT

Interesting on a PA500 wich is onder my administration, The average management cpu usage dropped 10%

Where: doing inboud/outbound SSL decryption/ Full threat protection/pandb url filtering/4 UIA

The previous version was 6.1.8

Re: Higher Management CPU post upgrade to 7.0.4

Brandon_Wertz — Wed, 20 Jan 2016 14:48:31 GMT

@syadav A co-worker of mine IMs me today and says "hey, did you know there's a wide open PCAP that's been running?"

For a period of time unknown to me someone turned PCAP on w/o any filters. I'm pretty much the day-to-day admin of our Palo enviornment with two other really knowledageable people providing assistance when necessary. There are some other, less knowledgeable people on our team that have access to the FW, and I'm guessing one of them accidently turned it on w/o realizing it.

It just never occured to me that someone would actually leave on a setting w/such a blatant performance warning.

Post turning the PCAP off Management CPU is down to around 10/15%.

On a related note, I looked through the System and Configration logs and I can't find any record of any modification of the PCAP settings do you know if there's someway to track that change history?

Re: Higher Management CPU post upgrade to 7.0.4

syadav — Wed, 20 Jan 2016 14:59:12 GMT

@Brandon_Wertz...seems I was spot on ! 😉

Regarding pcap log, On top of my head, I dont remember any particular log file which would log the pcap setting but following comand can be used to see the realtime setting :

admin@PA-VM> debug dataplane packet-diag show setting

--------------------------------------------------------------------------------

Packet diagnosis setting:

--------------------------------------------------------------------------------

Packet filter

Enabled: no

Match pre-parsed packet: no

--------------------------------------------------------------------------------

Logging

Enabled: no

Log-throttle: no

Sync-log-by-ticks: yes

Features:

Counters:

--------------------------------------------------------------------------------

Packet capture <<<<<<<<<<<<<<<<

Enabled: no

Snaplen: 0

--------------------------------------------------------------------------------

A painful way of achieving this would be writing a script and fetching this output periodically.