topic Re: Data plane - usage in General Topics

Data plane - usage

jdprovine — Thu, 20 Oct 2016 16:37:22 GMT

What would cause the data plane that has been running aroun 25% start running at 35-40%? Is there away to track down the reason

Re: Data plane - usage

BPry — Thu, 20 Oct 2016 16:57:24 GMT

Lots of things actually. Do you have more sessions going through the data plane for some reason, did someone install something that is chatting to another zone, are people streaming more media, software bug? I think the first thing to look at would be if your session count is higher than it normally is and go from there.

Re: Data plane - usage

jdprovine — Thu, 20 Oct 2016 18:39:08 GMT

so where is the best place to see if you session count has increased?

Re: Data plane - usage

santonic — Fri, 21 Oct 2016 06:33:21 GMT

Automatic reports are good way to start. Traffic reports in particular.

Re: Data plane - usage

jdprovine — Fri, 21 Oct 2016 14:07:04 GMT

I think I am going to have to create a custome report I don't see any of the premade report with what I need. They show total sessions but does not show how it increases over time

Re: Data plane - usage

jdprovine — Fri, 21 Oct 2016 14:16:33 GMT

I am not finding a graph of any sort in the reports that show the increase of session unless I am missing something

Re: Data plane - usage

BPry — Fri, 21 Oct 2016 14:18:15 GMT

If you have already been monitoring total bandwidth usage or application statistics you could get the same information in a more round-about way.

Re: Data plane - usage

jdprovine — Fri, 21 Oct 2016 14:28:00 GMT

Can you give me an example?

Re: Data plane - usage

BPry — Fri, 21 Oct 2016 20:00:52 GMT

If you have reports for application statistics along with sorting by the number of sessions then you can somewhat monitor the number of sessions on your network. I've included a screenshot of how I have mine setup. To the best of my knowledge you can't have a report for the number of sessions. We use the API to pull the output and save it to a text document so that we can somewhat manuanually monitor it if needed.

Re: Data plane - usage

jdprovine — Fri, 21 Oct 2016 20:38:59 GMT

So this is a custom report? Let me see if I can configure something similar thanks. I will let you know if it gives me what I need

Re: Data plane - usage

jdprovine — Fri, 21 Oct 2016 20:42:30 GMT

I tried that and at first glance this is something I would have to run regularly and then compare numbers of previous report to see if things are increasing. It would probably work I was just wanting something in a line graph no bar graphs so I can see an overall increase

Re: Data plane - usage

BPry — Fri, 21 Oct 2016 20:55:57 GMT

Okay. Closest thing to that would be the Pan(w)achrome extension for Google Chrome; that will give you basic information such as bandwidth and session as long as you allow it access to your firewall with your credentials. That sounds like something more that your looking for, however it still doesn't keep track of historical information for very long as all; for that you would probably be looking at something like SolarWinds

Re: Data plane - usage

Brandon_Wertz — Fri, 21 Oct 2016 21:39:01 GMT

I've referenced it before (a monitoring best practices' doc from palo), but if you've got any sort of Network Management you can use these MIBs to chart exactly what you're looking for:

Re: Data plane - usage

kiwi — Mon, 24 Oct 2016 11:15:12 GMT

Hi,

Have you tried SNMP monitoring ? As Brandon points out in the previous comment you should get plenty of info with OID and SNMP monitoring. You will need a network monitoring tool like Cacti (I just picked a random one).

This might be useful :

Cacti-Templates

SNMP-for-Monitoring-Palo-Alto-Networks-Devices