Eventid eq routed-OSPF-neighbor-down

Mohammed_Yasin — Sun, 19 Apr 2020 06:45:33 GMT

PAN-OS - 8.1.12

Want to understand the below Massage and Why it occurs ??

>less mp-log routed.log

2020-04-15 09:28:05.296 +0400 TM_SPF: start full SPF calculation rid 172.16.80.16
2020-04-15 09:28:05.296 +0400 TM_SPF: Do the full SPF calculation rid 172.16.80.16
2020-04-15 09:28:05.296 +0400 TM_SPF: full routing calculation finished rid 172.16.80.16
[63;1H[K[7m67%[27m[63;1H[63;1H[K2020-04-15 09:28:41.421 +0400 TM_SPF: start full SPF calculation rid 172.16.80.16
2020-04-15 09:28:41.421 +0400 TM_SPF: Do the full SPF calculation rid 172.16.80.16
2020-04-15 09:28:41.423 +0400 TM_SPF: full routing calculation finished rid 172.16.80.16
2020-04-15 09:28:42.768 +0400 Received dp HA status 'sw.dha.status' event change
2020-04-15 09:28:42.768 +0400 Received dp HA status 'sw.dha.status' event change
2020-04-15 09:28:42.768 +0400 Received dp HA status 'sw.dha.status' event change
2020-04-15 09:28:42.768 +0400 Received dp HA status 'sw.dha.status' event change
2020-04-15 09:28:42.768 +0400 Received dp HA status 'sw.dha.status' event change
2020-04-15 09:28:42.768 +0400 Received dp HA status 'sw.dha.status' event change
**** AUDIT 0x3e01 - 91 (0000) **** I:01d49552 F:00000002
qodmnmi.c 215 :at 09:28:46, 15 April 2020 (1225940386 ms)
OSPF 1 An adjacency with a neighbor has gone down.
Resources associated with database exchange for this neighbor will be
freed.
Neighbor router ID 172.16.80.12
Neighbor IP address 172.16.80.12
Interface category network interface
Interface neighbor IP addr 172.16.80.12 i/f idx 0X00000000

**** AUDIT 0x3e01 - 210 (0000) **** I:01d49552 F:00000002
qoamnfsa.c 768 :at 09:28:46, 15 April 2020 (1225940388 ms)
OSPF 1 i/f idx 0X00000011 rtr ID 172.16.80.12 IP addr 172.16.80.12 neighbor FSM state has deteriorated.
Interface address = IP addr 172.16.80.16
OSPF link category = 1
Is neighbor virtual? = 0
FSM input = QOAM_NBR_1WAY_RCVD (11)
Old FSM state = AMB_OSPF_NBR_FULL (8)
New FSM state = AMB_OSPF_NBR_INIT (3)
FSM action = K (11)
Neighbor friend status = 1
Number of neighbor events = 7
Number of database exchange timeouts = 0

2020-04-15 09:28:51.178 +0400 TM_SPF: start full SPF calculation rid 172.16.80.16
2020-04-15 09:28:51.178 +0400 TM_SPF: Do the full SPF calculation rid 172.16.80.16
2020-04-15 09:28:51.179 +0400 TM_SPF: full routing calculation finished rid 172.16.80.16
2020-04-15 09:28:54.109 +0400 IFMon: refresh ifstates, server path sw.dev.runtime.
2020-04-15 09:29:13.340 +0400 TM_SPF: start full SPF calculation rid 172.16.80.16
2020-04-15 09:29:13.340 +0400 TM_SPF: Do the full SPF calculation rid 172.16.80.16
2020-04-15 09:29:13.341 +0400 TM_SPF: full routing calculation finished rid 172.16.80.16
2020-04-15 09:29:41.955 +0400 TM_SPF: start full SPF calculation rid 172.16.80.16
2020-04-15 09:29:41.955 +0400 TM_SPF: Do the full SPF calculation rid 172.16.80.16
2020-04-15 09:29:41.956 +0400 TM_SPF: full routing calculation finished rid 172.16.80.16
2020-04-15 09:29:42.768 +0400 Received dp HA status 'sw.dha.status' event change
2020-04-15 09:29:42.768 +0400 Received dp HA status 'sw.dha.status' event change
2020-04-15 09:29:42.768 +0400 Received dp HA status 'sw.dha.status' event change
2020-04-15 09:29:42.768 +0400 Received dp HA status 'sw.dha.status' event change
2020-04-15 09:29:42.769 +0400 Received dp HA status 'sw.dha.status' event change
2020-04-15 09:29:42.769 +0400 Received dp HA status 'sw.dha.status' event change
**** AUDIT 0x0303 - 76 (0000) **** I:01d49696 F:00000002
sckutil.c 1612 :at 09:29:43, 15 April 2020 (1225997979 ms)
Closed a socket
Socket ID = 2577
Socket type = 0X00000003
Socket family = 0X00000002
Socket protocol = 0X000000FA

**** AUDIT 0x3e01 - 215 (0000) **** I:01d496a0 F:00000010
qoamddsc.c 260 :at 09:29:43, 15 April 2020 (1225997982 ms)
DB DESCRIPTION packet received with mismatched interface MTU size 9000 but
it will be accepted because the MtuIgnore MIB option is set to true.
An adjacency may form but it could fail later due to the mismatch.
[63;1H[K[7m67%[27m[63;1H[63;1H[KExpected MTU size = 1500
Neighbor router ID = 172.16.80.12
Packet data =
23285202 3919AEDA 06952201 AC100152 AC100152 80003209 8346003C 00060201
AC10500A AC10500A 80011A17 3FDA0024 00062201 AC10500C AC10500C 80011437
BE6E0030 00390201 AC105010 AC105010 8000DE09 D8140024 02F10201 C2AA8784
C2AA8784 800037D9 B24E0030 07042202 AC10015B AC10500C 800031E0 31A30020
00012202 AC10500C AC10500C 800051FD 09BF0020 00390202 AC105010 AC105010
80000001 D8520020 06050205 00000000 AC105010 8000819E 088D0024 00AC8205
0A000000 C2AA8784 800001DE E4F60024 04060205 0A103200 AC10500A 80006CCD
A1930024 04060205 0A103300 AC10500A 80006CCD 969D0024 04060205 >>>>>>

2020-04-15 09:29:46.957 +0400 TM_SPF: start full SPF calculation rid 172.16.80.16
2020-04-15 09:29:46.957 +0400 TM_SPF: Do the full SPF calculation rid 172.16.80.16
2020-04-15 09:29:46.958 +0400 TM_SPF: full routing calculation finished rid 172.16.80.16
2020-04-15 09:29:54.609 +0400 IFMon: refresh ifstates, server path sw.dev.runtime.
2020-04-15 09:29:56.282 +0400 TM_SPF: start full SPF calculation rid 172.16.80.16
2020-04-15 09:29:56.282 +0400 TM_SPF: Do the full SPF calculation rid 172.16.80.16
2020-04-15 09:29:56.282 +0400 TM_SPF: full routing calculation finished rid 172.16.80.16
2020-04-15 09:30:25.112 +0400 TM_SPF: start full SPF calculation rid 172.16.80.16
2020-04-15 09:30:25.112 +0400 TM_SPF: Do the full SPF calculation rid 172.16.80.16
2020-04-15 09:30:25.112 +0400 TM_SPF: full routing calculation finished rid 172.16.80.16
2020-04-15 09:30:37.926 +0400 TM_SPF: start full SPF calculation rid 172.16.80.16
2020-04-15 09:30:37.926 +0400 TM_SPF: Do the full SPF calculation rid 172.16.80.16
2020-04-15 09:30:37.927 +0400 TM_SPF: full routing calculation finished rid 172.16.80.16
**** AUDIT 0x3e01 - 200 (0001) **** I:01d4981c F:00000002
qoamutil.c 278 :at 09:30:41, 15 April 2020 (1226056165 ms)
OSPF 1 Database exchange with an adjacent OSPF neighbor has been completed.
The adjacency with this neighbor is now fully up.
Neighbor router ID 172.16.80.12
Neighbor IP address 172.16.80.12
Interface category network interface
Interface neighbor IP addr 172.16.80.12 i/f idx 0X00000000

2020-04-15 09:30:42.768 +0400 Received dp HA status 'sw.dha.status' event change
2020-04-15 09:30:42.768 +0400 Received dp HA status 'sw.dha.status' event change

Re: Eventid eq routed-OSPF-neighbor-down

kiwi — Mon, 20 Apr 2020 12:32:58 GMT

Hi @Mohammed_Yasin ,

It looks like your OSPF adjacency flapped.

As to why this happened you'll need to do further debugging.

The timeframe allows you to narrow down and check other logs for related events. Also check the traffic log during the timeframe when this occured.

Get the TSF and have it analysed by support.

Cheers,

-Kiwi.

topic Eventid eq routed-OSPF-neighbor-down in General Topics

Eventid eq routed-OSPF-neighbor-down

Re: Eventid eq routed-OSPF-neighbor-down