brdagent restarted unexpectedly

[RovshanRajabli]

Dear Team!

Hi once again.

The system goes into maintenance mode. But before the system goes maintenance mode, I faced that all traffic is in "Incomplete status."
After that, the firewall goes into maintenance mode. 
 
After rebooting, all works correctly. But, the main question: What was that? The root cause of the problem.

I checked the resource monitored, and all was correct, with no stuck deamons\process.
 
By TSF I found a crash info file of brdagent, and this kind of critical alerts
 

Does somebody face this problem? For more information please pin me. Thank you!

1 (2023-06-16 07:16:13)	Critical	System	brdagent					brdagent restarted unexpectedly however no known issue was identified. Please open a case if further assistance is required.
1 (2023-06-16 07:32:12)	Critical	System	dssd					dssd restarted unexpectedly however no known issue was identified. Please open a case if further assistance is required.

[Arnesh]

Hi @RovshanRajabli 

Thank you for sharing the information.
We can understand the reason for the packets been classified as "Incomplete" from KB. Regarding the brdagent process, it is responsible for the panel ports
I would look at the masterd logs at the time of the issue to understand if brdagent is the culprit or the victim of the issue.
As you can see the creashinfo files from the TSF, there will be Core files generated on the device. Check them using command

> show system files
I would suggest to open a TAC case and provide the TSF, Core files and/or any other required details for investigation of the issue.

REegards,

Arnesh Handoo

[RovshanRajabli]

Dear Arnesh,

After we faced "Incomplete", traffic stopped and Firewall goes into maintenance mode. The firewall is VM. I got 3 crash logs, for brdagent, for dssd and for all tasks.

[Arnesh]

Hi @RovshanRajabli 

traffic marked as "incomplete" is not a good reason for the firewall to enter maint mode. Please raise a TAC case to understand if your device is hitting a bug . BTW, what is the capacity of the VM (for example, vm-100, vm-300, etc) and what is the PAN-OS version installed?

Regards,

Arnesh

[RovshanRajabli]

Dear.
Its VM-300. Pan-OS : 10.1.6-h3.

[Arnesh]

We may need to look further into the logs to identify the issue and TAC can help you with that. We can also check the "Known Issues" provided by PaloAlto for any suspecting Bugs.
Also, you can check the following which can be of help - Palo Alto Networks VM-Series Firewall suddenly restarts unexpectedly due to disk I/O performance.

Regards,

Arnesh