Commit Failing on 5.0.2

[omer]

Hi,

we have recently updated our our two PaloAlto 4050 from version 4.1.8 to version 5.0.2. Since after the update we face a lot of commit failing problems. and the device response becoming very slow.

is it a known bug ? or is there any way around ?

[gswcowboy]

Please determine job id for failed job and provide output for the following

admin@PA-500(suspended)> show jobs id <value>

  <value>  <1-4294967296> By id

admin@PA-500(suspended)> show management-clients

admin@PA-500(suspended)> show system files

[omer]

Kindly check the following screenshots.

Show job id output

show management-client

show system files output

[gswcowboy · Accepted solution]

The mgmtsrvr appears to be having issues relaying the first phase of the commit to the authd/sslvpn processes per your output. You also have core files generated on your host. I would call PAN Support or your ASC (Authorized Service Center) to get a case open and a live debug session. We'd need to debug the issue further given the results provided. Thanks!

[omer]

Well, currently we are stuck in a "premium partner support" contract and that partner is providing us really crappy service. I'll try to make live debug session with the PAN Support.

Meanwhile if you look at the management client, the client "logrcvr" is stuck at init phase.

is there a way to restart the logrcvr process ? ?

[gswcowboy]

This is the syntax to restart said process. Prior to restarting, however, execute the trace command 3x and output to the putty.log. In addition, core the process in question as well. If feasible, have the ASC create the case on your behalf. This will help with analysis.

admin@oliver(active)> debug software trace log-receiver <== run 3x and output to putty.log

admin@oliver(active)> debug software core log-receiver

Confirm PID for that process before restarting. Once restarted, confirm PID has changed.

admin@oliver(active)> show system software status | match logrcvr

Process  logrcvr              running  (pid: 2305)

admin@oliver(active)> debug software restart log-receiver

[omer]

Thanks, i was able to restart the logrcvr process. and yes its id changed after the restart.

but the overall behavior of the management interface is very slow. and commit are still getting failed.

now, i am seriously thinking about downgrading it to 4.1.8. which was working before.

[gswcowboy]

Definitely need to debug live. Have your ASC call PAN Support with you on the line so we can take a closer look.

[lavision]

I also observed very slow response from the management interface after upgrading our PA500 fromn PanOs 5.0.1 to 5.0.2

My SNMP network monitoring showed the management CPU to be stuck at 100% load. A reboot temporarily solved this high load issue, but after some time the management CPU was again permanently at 100% load.

My only resolution was to go back to 5.0.1, and this helped in my case.

[zarina]

Lavision,

Please open a case with PAN Support or your ASC so that we can investigate the high CPU issue.

Thanks,

Sri

[lavision]

The problem did not show again after upgrading to 5.0.3