topic Re: Over 110% untilization in General Topics

Over 110% untilization

jdprovine — Wed, 03 May 2017 16:19:19 GMT

I am seeing my management plane spiking over 100% when do a preview and a commit, what could be causing that ? Also can a defrag be run or need to be run on the hard drive?

Re: Over 110% untilization

BPry — Wed, 03 May 2017 21:09:12 GMT

debug system check-fragment

debug system disk-smart-info

May both be of assistance if you suspect a drive issue.

Re: Over 110% untilization

jdprovine — Wed, 03 May 2017 21:19:13 GMT

so can these be running during normal business hours? Will it affect performance - you knew I had to ask 🙂

Re: Over 110% untilization

jdprovine — Thu, 04 May 2017 13:52:11 GMT

The times that the management plane utilization seemed to spike the most so far is when using the ACC, previewing a commit or a commit.

Re: Over 110% untilization

BPry — Thu, 04 May 2017 15:54:05 GMT

@jdprovine,

You can view the smart info during business hours; the fragmentation test takes about 5 minutes and I wouldn't do it during business hours if you can avoid it. I beleive that the only way to actually de-frag the drive is in Maintenance mode.

Re: Over 110% untilization

jdprovine — Thu, 04 May 2017 20:29:57 GMT

How do you put the drive in maintenance mode?

Re: Over 110% untilization

Brandon_Wertz — Fri, 05 May 2017 01:10:21 GMT

@jdprovine I believe @BPry was suggesting the entire firewall be put into maintenance mode. I don't think you can put a single drive in MM.

That being said...What type of HDs does your FW have? If SSDs I believe the general consensus is to not defrag them as it reduces the lifespan of the drives:

http://www.pcworld.com/article/2047513/fragging-wonderful-the-truth-about-defragging-your-ssd.html?page=2

Re: Over 110% untilization

BPry — Fri, 05 May 2017 03:04:29 GMT

Correct, if memory serves correctly you can Defrag a hard drive in maintenence mode. @Brandon_Weitz is correct. If memory serves correct I believe you have 3020s correct, so they would have non SSD drives unless you have upgraded them yourself.

Re: Over 110% untilization

jdprovine — Fri, 05 May 2017 13:11:59 GMT

Well I have a PA 5050 - so whatever drive came in it is what I have, But I do have an HA pair I suppose I could fail it over to the secondary and then run a defrag on the primary and then fail back. I am not sure that at this point the issues really point to the hard drive as yet. As mentioned on a previous comment at this time it appears that the issues occur when using the ACC, previewing a commit and doing a commit

Re: Over 110% untilization

jdprovine — Fri, 05 May 2017 13:12:50 GMT

I had a 3020 in my last job but at my current job we have an HA pair of 5050's

Re: Over 110% untilization

jdprovine — Fri, 05 May 2017 13:14:16 GMT

@Brandon_Wertz the link you sent does not work for me

Re: Over 110% untilization

Brandon_Wertz — Fri, 05 May 2017 13:23:36 GMT

Sorry about that I copied a URL from "page 2" apparently that doesn't work:

http://www.pcworld.com/article/2047513/fragging-wonderful-the-truth-about-defragging-your-ssd.html

Re: Over 110% untilization

Brandon_Wertz — Fri, 05 May 2017 13:26:56 GMT

Hrmm...I think there might be something messed up with how the Palo site is coded because I can't get the HTML link to open when clicking on it on this site, but when going to it from my Chrome history or from a Google search it opens just fine. (See the URLs are the same)

Re: Over 110% untilization

Brandon_Wertz — Fri, 05 May 2017 13:28:50 GMT

@BPry learned something new, thanks. Didn't know you can put a single drive in maintenance mode.

Re: Over 110% untilization

BPry — Fri, 05 May 2017 13:46:21 GMT

@jdprovine,

O okay. Ya I thought I recalled you mentioning 3020 prior so I was going off that assumption. One thing you could try to do is the following when you are actually experiancing a high CPU count. Probably best to log the whole SSH session output.

> show jobs all (check for running jobs)
> set cli pager off (results will be fully expanded, you won't need to hit enter to scroll to the bottom of the results)
> debug management-server memory info (To check for fragmentation counter in ‘arena’ field)
> debug log-receiver statistics (To check whether logging is too high)
> show system software status (to associate running processes with IDs)
> show management-clients
> show system resources follow
Press number ‘1’ and then followed by <shift>H (to show threads). Let it run for a 30 seconds. Hit ‘M’ to sort by memory usage. Let it run for 30 seconds, and press ‘q’ to quit from it.
> show system disk-space

All of this can be run without much load to the CPU so I wouldn't be to worried about running it during the day. If you want to have the cli paging turned back on just remember to run the set cli pager on command; but leaving it off isn't going to cause any ill affects to your device, I actually leave paging disabled on my units so I don't have to scroll through the results.

Re: Over 110% untilization

jdprovine — Fri, 05 May 2017 15:14:23 GMT

I will definitely try your suggestion and let you know what I see Thanks @BPry

Re: Over 110% untilization

jdprovine — Fri, 05 May 2017 15:38:24 GMT

Filesystem Size Used Avail Use% Mounted on
/dev/md3 3.8G 3.1G 509M 87% /
/dev/md5 7.6G 3.2G 4.0G 45% /opt/pancfg
/dev/md6 3.8G 2.6G 1019M 73% /opt/panrepo
tmpfs 2.0G 116M 1.9G 6% /dev/shm
cgroup_root 2.0G 0 2.0G 0% /cgroup
/dev/md8 198G 120G 69G 64% /opt/panlogs

Re: Over 110% untilization

jdprovine — Fri, 05 May 2017 15:51:37 GMT

It also showing me logged in twice on the CLI when I am only logged in once

here are the processes when I am using the ACC

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
31021 root 20 0 953m 213m 6444 S 159.0 5.4 131:38.93 mgmtsrvr
4139 root 20 0 1272m 435m 7200 S 5.6 11.0 3977:01 logrcvr
26265 nobody 20 0 149m 26m 6032 S 0.7 0.7 13:39.07 appweb3
12839 root 20 0 12948 2352 1648 S 0.3 0.1 47:41.76 packet_path_pin
26411 nobody 20 0 114m 7648 4456 S 0.3 0.2 9:22.34 appweb3
1 ro

Re: Over 110% untilization

mpgioia — Fri, 05 May 2017 15:59:43 GMT

@Brandon_Wertz wrote:
Sorry about that I copied a URL from "page 2" apparently that doesn't work:

http://www.pcworld.com/article/2047513/fragging-wonderful-the-truth-about-defragging-your-ssd.html

The URL had a '%C2%A0' suffixed at the end. Drop that off and it will work.

Re: Over 110% untilization

jdprovine — Fri, 05 May 2017 16:09:00 GMT

Great that one works