Constantly receiving this error - SYSTEM ALERT : high : l3svc: Exited 4 times, waiting 1890 seconds to retry

[Ben-Price]

Hi,

I have a client that was receiving the below error occasionally (every 2 weeks or so).

'SYSTEM ALERT : high : l3svc: Exited 4 times, waiting 1890 seconds to retry'

The client was on PAN OS 9.1.3 and then updated to 9.1.7 and now the error is appearing constantly. The l3svc daemon is in a stopped state and a restart brings it back to a running state briefly, but then it crashes again.

I have asked them to try to restart the management server to see if that resolves the issue. 

Has anyone come across this issue before or can advise any further troubleshooting steps?

Thanks in advance.

[Remo · Accepted solution]

Hi @Ben-Price 

Looks like a bug. As a first step, please update to the current preferred release which is PAN-OS 9.1.10 anf check if the error is still there.

[Ben-Price]

Hi @Remo 

Thanks for your response, I have asked them to try and update to PAN OS 9.1.10.

I also had them try to clear some space in the root partition as it was at 96%. They have followed the below KB article and that has taken it down to 88%, but the l3svc daemon is still crashing. Would a root partition with 88% utilized cause such an issue? Do you think the root partition needs more cleaning up?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS

Thanks

[BPry]

@Ben-Price,

Disk space shouldn't really be effecting that process at all. One thing that I might actually try as a basic troubleshooting method is temporarily removing any customizations they've made to response pages (back up the files if they don't have them backed up already). The l3srv process is what actually serves those sort of pages and it's possible that something in their customized pages (if applicable) can't be served properly. 

[Ben-Price]

@Remo @BPry Thanks for your input. The client has updated their PAN OS version to 9.1.10 and this has resolved the issue.