Action Center - slow to process actions

[tsamidon]

Has anyone else been encountering situations where the Action Center is snail slow in processing any actions i.e  retrieve support files, search files & delete by path etc.? 

[neelrohit]

Hi @tsamidon ,

Thank you for writing to live community!

The action center is simply a page to list out the actions carried out on the agent from the Cortex XDR cloud console. The actions are received by the agent upon the next heartbeat. If you have agents receiving the updates with delay, you might want to check the agent bandwidth management settings under global settings options.

Also, there could be a possibility that the agent is not able to fetch action center in form of payload because of intermittent network connectivity issues or very high utilisation on the machine which is not allowing the agent to perform normal actions.

You also might want to check if the agent has disk quota limit issues as the agent tends to purge payload files if the disk quota limit has exceeded.

All of the above mentioned are possibilities and might need some investigation. You can always reach out to Palo Alto Support team to investigate in detail and also validate issues from the backend on the cloud.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards

[tsamidon]

Hi @neelrohit 

Thank you for your reply. After engineering went through our support case - it was found that it is not related to the agent. We inspected the logs of several endpoints that had multiple actions hanging or failing across the enterprise and everything looked pretty normal on the agent side. Then we looked at the resources in our tenant and Palo throttle our resources up - then we started to see some improvement. We were also informed that version 3.6 would improve some of the UI/tenant issues that we were facing currently on version 3.5. We feel that the endpoint received and responded to the actions however XDR was not able to update the action status on the console.  

We are still investigating this and thank you for sharing the information on the agent bandwidth management settings. 

Thanks