Constantly receiving this error - SYSTEM ALERT : high : l3svc: Exited 4 times, waiting 1890 seconds to retry

cancel
Showing results for 
Search instead for 
Did you mean: 

Constantly receiving this error - SYSTEM ALERT : high : l3svc: Exited 4 times, waiting 1890 seconds to retry

L4 Transporter

Hi,

I have a client that was receiving the below error occasionally (every 2 weeks or so).

'SYSTEM ALERT : high : l3svc: Exited 4 times, waiting 1890 seconds to retry'

The client was on PAN OS 9.1.3 and then updated to 9.1.7 and now the error is appearing constantly. The l3svc daemon is in a stopped state and a restart brings it back to a running state briefly, but then it crashes again.

I have asked them to try to restart the management server to see if that resolves the issue. 

 

Has anyone come across this issue before or can advise any further troubleshooting steps?

 

Thanks in advance.

1 ACCEPTED SOLUTION

Accepted Solutions

Cyber Elite
Cyber Elite

Hi @Ben-Price 

Looks like a bug. As a first step, please update to the current preferred release which is PAN-OS 9.1.10 anf check if the error is still there.

View solution in original post

4 REPLIES 4

Cyber Elite
Cyber Elite

Hi @Ben-Price 

Looks like a bug. As a first step, please update to the current preferred release which is PAN-OS 9.1.10 anf check if the error is still there.

L4 Transporter

Hi @vsys_remo 

 

Thanks for your response, I have asked them to try and update to PAN OS 9.1.10.

 

I also had them try to clear some space in the root partition as it was at 96%. They have followed the below KB article and that has taken it down to 88%, but the l3svc daemon is still crashing. Would a root partition with 88% utilized cause such an issue? Do you think the root partition needs more cleaning up?

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS

 

Thanks

Cyber Elite
Cyber Elite

@Ben-Price,

Disk space shouldn't really be effecting that process at all. One thing that I might actually try as a basic troubleshooting method is temporarily removing any customizations they've made to response pages (back up the files if they don't have them backed up already). The l3srv process is what actually serves those sort of pages and it's possible that something in their customized pages (if applicable) can't be served properly. 

L4 Transporter

@vsys_remo @BPry Thanks for your input. The client has updated their PAN OS version to 9.1.10 and this has resolved the issue.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!