topic Re: PA-5050-Data plane showing high in General Topics

PA-5050-Data plane showing high

VishnuPS — Fri, 11 Jun 2021 12:31:39 GMT

Dear Team,

Our Core firewall Data plane CPU reaching to 99% , When we checking the traffic logs some MS-SQL application getting high usage, and system logs are showing "dataplane under severe load palo alto".

Pan os : 8.1.15-h3 ,Device : PA 5050.

Kindly let us know any solutions for this.

Reagrds,

Vishnu.

Re: PA-5050-Data plane showing high

BPry — Sat, 12 Jun 2021 03:23:56 GMT

@VishnuPS,

Kind of sounds like you've already done the investigation and found out what traffic is causing your increased Dataplane usage. So is this a new process, was there a recent update, are you questioning if the Dataplane should actually be running that high?

Re: PA-5050-Data plane showing high

VishnuPS — Sat, 12 Jun 2021 03:53:57 GMT

kindly go through session statistic when data CPU reaches up to 99%.

Packet rate : 168808/s
Throughput : 454239 Kbps
Total active sessions : 245723
Active TCP sessions : 189741
Active UDP sessions : 47866
Active ICMP sessions : 2954

The session count is showing 2.45 lakh and device is having capacity 16lakh hence is that box not having that much capacity

Regards,

Vishnu

Re: PA-5050-Data plane showing high

BPry — Sat, 12 Jun 2021 04:09:22 GMT

@VishnuPS,

There's a lot more to dataplane usage than just session stats and throughput. Why did you initially mention SQL traffic in your original post, what was pointing you towards that traffic?

What do your pools like like? You could be running into a pool depletion issue, and if that's the case you can match it against resource-monitor.

Re: PA-5050-Data plane showing high

VishnuPS — Sat, 12 Jun 2021 04:23:23 GMT

We have using IP-based policies, let me collect some more logs.

Also please mention what logs are we need to collect for dataplane CPU usage?

Regards,

Vishnu PS.

Re: PA-5050-Data plane showing high

BPry — Sun, 13 Jun 2021 04:06:50 GMT

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRTCA0

@VishnuPS,

Start with the above linked document, and I would recommend reaching out to TAC to have them walk through this process with you if this is the first time you are having to troubleshoot this issue.

Re: PA-5050-Data plane showing high

VishnuPS — Tue, 15 Jun 2021 09:38:41 GMT

Yes, We have tried to implement app override for ms-sql application, issue still the same. We are working with TAC.

I Will update here once we got any solution.

Thank you