8.0.2 Management SLOW, SLOW, SLOW on PA500

[ppeters86]

Has anyone else noticed that the management functions through the web interface are incredibly slow with 8.0.2?  Committing even a simple change brought these timings:

- 1:10 just to get the progress bar beyond zero

- 3:42 to complete the commit.

Seems awfully slow....

[BPry]

When was this actually updated, within the first 24 hours the system is known to run much slower. I haven't used the PA500 series but I don't recall it being a particularly fast device to being with  right? 

[Raido_Rattameister]

8.0.x is not yet suggested on PA200 and PA500.

Probably it needs some more resource tuning and code cleanup.

[TranceforLife]

Still, it takes quite too long to commit l think, even for PA500 series. Do you know what is "eating" your MP CPU, which process? 

>  show system resources follow

Did you try to restart a mgmt process?

> debug software restart process management-server

[Remo]

@Raido_Rattameister
What do you mean with "not yet suggested"? Is this an official statement of PAN? Do you know about more problems than a slow mgmt?
I noticed that it is slower than before on a PA200, but everything else runs perfectly till now...

[Raido_Rattameister]

No it is not official statement but came up in chat with TAC person.

Check if it is newer 500 with more ram.

https://live.paloaltonetworks.com/t5/Management-Articles/PA-500-MP-Memory-Upgrade/ta-p/54483

[BPry]

@Remo,

Slow management and you're more likely to have a process hang. It isn't that it isn't usable but the earlier versions of the 500 and the 200 simply don't have the resources to keep up with everything. I was actually suprised to see the earlier version of the 500 remain supported. 

[ppeters86]

The poor performance was more than 24 hours after the upgrade.  It's pretty consistently slow on the management side.  The device seems to be keeping up with moving traffic.

[ppeters86]

Interesting that it's not suggested.  The device certainly offered the upgrade to me.  Odd that the device offered an upgrade that's not fully "cooked" for this platform.

[ppeters86]

I looked at system resources (show system resources follow).  I'm not seeing huge CPU utilization (load average often less than 2).

I restarted the mgmt process last week.  I don't think this made any noticable difference.

BTW, I have the 2 GB RAM model of the PA-500.

[TranceforLife]

So mgmt CPU is not actually 100% while you doing a commit? Going to play a darts now but I would try just simple to reinstall the PAN-OS otherwise, seek help from TAC.

[SuryaR]

@ppeters86 Do you see slowness only during commit or also browsing through the GUI.

If it is only commit then here is my  guess. Every job is enqued starting version 8.0.0.

Prior versions had an instant commit(In other words may be non-critical jobs are queued in the latest OS).

Here is a comparision of 8.0.x compared to 6.x.x

8.0.2:

user @ PA-500(active)# commit

Commit job 220 is in progress. Use Ctrl+C to return to command prompt

.......^C

Commit is in process

You can run the following command to monitor its status:

# run show jobs id 220

#show jobs all

Enqueued                   Dequeued           ID  PositionInQ                              Type                         Status Result Completed

------------------------------------------------------------------------------------------------------------------------------------------

2017/05/22 20:28:42                         220            1                        Commit                        QUEUED   PEND         0%

2017/05/22 20:28:30   20:28:30          219                                     EDLRefresh                            ACT   PEND        99%

2017/05/22 08:00:01   08:00:01          218                                     EDLRefresh                            FIN     OK 08:00:02 

Where as in 6.x.x:

show jobs all

Enqueued                     ID             Type    Status Result Completed

--------------------------------------------------------------------------

2017/05/22 20:29:01       25644           Commit       ACT   PEND         0%

2017/05/22 20:15:59       25643      FqdnRefresh       FIN     OK 20:15:59 

Hope this helps.

Here is a small video of how things changed.

https://live.paloaltonetworks.com/t5/Community-Blog/Tutorial-Clearing-Commits/ba-p/155119

[greg_murphy]

A newer PAN-PA-500-2GB is abhorrently slow. Sometimes it take 10 minutes and more to upload and apply threats and applications. It's pretty hard to champion this product at work when other people have to use it, endless complaining. The slowness of this box is the a huge marketing nightmare.