Data plane - usage

[jdprovine]

What would cause the data plane that has been running aroun 25% start running at 35-40%? Is there away to track down the reason

[BPry]

Lots of things actually. Do you have more sessions going through the data plane for some reason, did someone install something that is chatting to another zone, are people streaming more media, software bug? I think the first thing to look at would be if your session count is higher than it normally is and go from there. 

[jdprovine]

so where is the best place to see if you session count has increased?

[santonic]

Automatic reports are good way to start. Traffic reports in particular.

[jdprovine]

I think I am going to have to create a custome report I don't see any of the premade report with what I need. They show total sessions but does not show how it increases over time

[jdprovine]

I am not finding a graph of any sort in the reports that show the increase of session unless I am missing something

[BPry]

If you have already been monitoring total bandwidth usage or application statistics you could get the same information in a more round-about way.

[jdprovine]

Can you give me an example?

[BPry]

If you have reports for application statistics along with sorting by the number of sessions then you can somewhat monitor the number of sessions on your network. I've included a screenshot of how I have mine setup. To the best of my knowledge you can't have a report for the number of sessions. We use the API to pull the output and save it to a text document so that we can somewhat manuanually monitor it if needed. 

[jdprovine]

So this is a custom report? Let me see if I can configure something similar thanks. I will let you know if it gives me what I need

[jdprovine]

I tried that and at first glance this is something I would have to run regularly and then compare numbers of previous report to see if things are increasing. It would probably work I was just wanting something in a line graph no bar graphs so I can see an overall increase

[BPry]

Okay. Closest thing to that would be the Pan(w)achrome extension for Google Chrome; that will give you basic information such as bandwidth and session as long as you allow it access to your firewall with your credentials. That sounds like something more that your looking for, however it still doesn't keep track of historical information for very long as all; for that you would probably be looking at something like SolarWinds

[Brandon_Wertz]

I've referenced it before (a monitoring best practices' doc from palo), but if you've got any sort of Network Management you can use these MIBs to chart exactly what you're looking for:

[kiwi]

Hi,

Have you tried SNMP monitoring ? As Brandon points out in the previous comment you should get plenty of info with OID and SNMP monitoring.  You will need a network monitoring tool like Cacti (I just picked a random one).

This might be useful : 

Cacti-Templates

SNMP-for-Monitoring-Palo-Alto-Networks-Devices