topic Re: Dataplane increment from 07/03/2018 in General Topics

Dataplane increment from 07/03/2018

soporteseguridad — Tue, 27 Mar 2018 07:30:21 GMT

Hi,

We realised that we have had an increment in dataplane from 07/03/2018. Before this day the normal value was 42% aprox. After that day the normal value is incremented to 58%. So we would like to know the reason for this increment.

I check "resource monitor", sessions, cpus, etc.... and i dont see anything about what it could cause this increment.

I was thinking about any dynamic updates installed that day, but im not sure.....

Some has suffered anything similar???

Re: Dataplane increment from 07/03/2018

reaper — Tue, 27 Mar 2018 11:55:59 GMT

did you check the ACC or application reports?

besided increased cpu, was there increased session usage or packets/second, more traffic for a specific application, possibly a backup or streaming session ?

Re: Dataplane increment from 07/03/2018

soporteseguridad — Wed, 28 Mar 2018 15:21:15 GMT

We detected a increment in the normal CPU dataplane valor from 35% to 55%. So its not a peak, its the normal % dataplane now. how could investigate this???

taking the dataplane troubleshooting in this link:

https://live.paloaltonetworks.com/t5/Featured-Articles/How-to-Troubleshoot-High-Dataplane-CPU/ta-p/73000

We didnt see any clear in command output...to reach the root cause.

Re: Dataplane increment from 07/03/2018

BPry — Wed, 28 Mar 2018 16:01:16 GMT

@soporteseguridad,

The Dataplane rising to a new utilization percentage really shouldn't be a huge concern, esspecially since you aren't stressing the dataplane CPU at all. With that being said however this is what I would look at.

1) Is your session utilization the same as it usually is, or has that increased overall since you noticed the uptick?

2) The Dataplane is where the majority of the work happens. Have you enabled additional signatures or setup SSL decryption or anything like that, as these would logically cause the Dataplane to show higher than it did without.

3) run show running resource-monitor ingress-backlogs and locate the top five sessions that are utilizing a larger packet buffer and post the output.