AIOps Management Plane CPU Alerts

[PeterJohnston]

I've recently started looking at the AIOps dashboard with the telemetry data submitted by our firewalls.  I've seen several alerts in AIOps for 'High Processing Activity'.  When you look at the detail of the alert I see a graph that shows an average of 75% or more average management CPU use over the last 7 days.  If that were true it would indeed be high.  However, if I view the management CPU data for the same device over a 7 day period in Panorama it shows a very different graph, with an average of about 8%.  Looking at our SNMP monitoring system it agrees with the Panorama monitoring, with an average of <10%.

Does anyone know why the AIOps telemetry is showing such wildly different results?

Thanks

Peter

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

[ravsingh]

Hi @PeterJohnston,
 

Could you please mention the model, the pan-os version you are using, and the aiops tenant id?
 

Regards,
Ravi Kumar Singh
Product Specialist
Palo Alto Networks
http://live.paloaltonetworks.com/t5/cloud-ngfw-help-center/ct-p/Cloud_NGFW
*Don’t forget to accept the solution provided!*
  

[PeterJohnston]

Hi

I've mostly seen this on PA-220 devices, all of which are currently running PANOS 10.1.6-h6.

The tenant ID is 309101444 (I think - I've pulled that out of the headers of requests to the AIOps dashboard.  If there is an 'official' way of determining the tenant ID then please advise)

Regards

Peter

[ravsingh · Accepted solution]

Hi Peter,

The AIOps backend team just confirmed that they are working on a fix for PA-220.  Let's just wait until the fix is done.

Regards,
Ravi Kumar Singh
Product Specialist
Palo Alto Networks
http://live.paloaltonetworks.com/t5/cloud-ngfw-help-center/ct-p/Cloud_NGFW
*Don’t forget to accept the solution provided!*

[PeterJohnston]

OK, thanks for the update @ravsingh.  I'll keep an eye on it and hopefully it will be corrected soon.

P

[MTeufel]

Should the problem be already fixed?

I'm having the same issue at the moment with a PA-820 an Software 10.2.4.

Martin