About traffic-stop-on-logdb-full feature

Reply
L0 Member

About traffic-stop-on-logdb-full feature

We're receiving multiple alerts "SYSTEM ALERT : critical : Traffic and logging are resumed since traffic-stop-on-logdb-full feature has been disabled ." for one fo the device, what needs to be done ? Please advise.

 

Thank you.

Community Manager

Re: About traffic-stop-on-logdb-full feature

you'll want to verify the stop traffic on log full setting as displayed below

log full.png

 

what version of PAN-OS are you running?


Help the community: Like helpful comments and mark solutions
Reaper out
L7 Applicator

Re: About traffic-stop-on-logdb-full feature

@reaper other option on this screenshot "Enable Log on High DP load" is one of most badly worded option in Palo GUI.

Can you suggest internally to rename it. For example "Log High DP load".

Currently it seems that logging will be stopped when DP is high but actually System log is written.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE (3.0, 5.0, 6.0, 7.0), PCNSE (6, 7), PCNSI
L7 Applicator

Re: About traffic-stop-on-logdb-full feature

@reaper

Today I also experienced this critical system log entries. The firewall is running PAN-OS 8.0.2 and the setting "Stop Traffic when LogDB Full" is NOT enabled. The log entries were flooding the system log with up to 400 logs / second. Unfortunately I was not able to resolve the issue and suddenly the firewall stopped processing connections completely. I then had to shut down ALL ports (dataplane interfaces were not enough to trigger a failover) because ssh, https and panorama context switch wasn't possible anymore ... was really fun today :P

Any advice regarding this situation?

Community Manager

Re: About traffic-stop-on-logdb-full feature

@vsys_remo whoa that doesn't sound good

 

I hope you got a techsupport file while it was in this state or were able to reach support

 

It sounds like something completely different was going on as the stop traffic option leaves your firewall in a rather 'relaxed' management state since its only blocking traffic from that point on (i never really understood this option but I guess there's a business need)

This sounds like the whole system was affected including several auxiliary daemons

 

There's not a lot of advice i can give for such a situation: the best thing is to contact TAC and resist the urge to reboot your firewall while they collect debug data

Too many times I've had cases linger for a long time because the firewall was rebooted, prior to contacting support, and was in a healthy state with nomore indication of what happened


Help the community: Like helpful comments and mark solutions
Reaper out
L7 Applicator

Re: About traffic-stop-on-logdb-full feature

Ok, these problems probably aren't related in any way. It's just bad luck.

 

After a few hours I decided to enable ONLY the managment port again --> complete cluster was down again ... I am going to contact support now as I did not reboot till now ... the problem is that the generating a tech support from the console also fails ... so there is definately something wrong here :P

 

EDIT: up to 1000 logdb-full system logs / second

L0 Member

Re: About traffic-stop-on-logdb-full feature

I have a customer running PAN-OS 8.0.4 on a PA-5050 and their firewall is generating thousands of these very same System Critical Log Messages, "Traffic and logging are resumed since traffic-stop-on-logdb-full feature has been disabled" daily (dozens by the second continually).  And the setting within your screenshot is NOT checked (Stop Traffic when LogDB Full).  However, I believe this is a known issue and is being addressed. 

Dave Gutierrez | Course Developer
Palo Alto Networks® | 4401 Great America Parkway | Santa Clara, CA. 95054 | USA
Education Website | https://www.paloaltonetworks.com/services/education.html
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!