Dataplane increment from 07/03/2018

[soporteseguridad]

Hi,

We realised that we have had an increment in dataplane from 07/03/2018. Before this day the normal value was 42% aprox. After that day the normal value is incremented to 58%. So we would like to know the reason for this increment.

I check "resource monitor", sessions, cpus, etc.... and i dont see anything about what it could cause this increment.

I was thinking about any dynamic updates installed that day, but im not sure.....

Some has suffered anything similar??? 

[reaper]

did you check the ACC or application reports?

besided increased cpu, was there increased session usage or packets/second, more traffic for a specific application, possibly a backup or streaming session ?

[soporteseguridad]

We detected a increment in the normal CPU dataplane valor from 35% to 55%. So its not a peak, its the normal % dataplane now. how could investigate this???

taking the dataplane troubleshooting in this link:

https://live.paloaltonetworks.com/t5/Featured-Articles/How-to-Troubleshoot-High-Dataplane-CPU/ta-p/7...

We didnt see any clear in command output...to reach the root cause.

[BPry]

@soporteseguridad,

The Dataplane rising to a new utilization percentage really shouldn't be a huge concern, esspecially since you aren't stressing the dataplane CPU at all. With that being said however this is what I would look at. 

1) Is your session utilization the same as it usually is, or has that increased overall since you noticed the uptick? 

2) The Dataplane is where the majority of the work happens. Have you enabled additional signatures or setup SSL decryption or anything like that, as these would logically cause the Dataplane to show higher than it did without. 

3) run show running resource-monitor ingress-backlogs and locate the top five sessions that are utilizing a larger packet buffer and post the output.