Dataplane PA2050 restart with no reasons. why?

[soporteseguridad]

Hi, i hope someone can help me about this error.

My primary (active) Palo Alto suddenly restarted yesterday with no reasons, thanks god HA worked and we are actually working with the secondary PA. I have checked the monitor system log and i cant find the reasons why my PA was restarted.

I attached a screenshot with the monitor system log. Thanks a lot

PA2050

Software version 5.0.3

[soporteseguridad]

I attach

show log system severity equal critical 2013/05/30 13:29:22 critical ha	connect 0  HA Group 1: HA1 connection down
2013/05/30 13:29:22 critical ha	connect 0  HA Group 1: All HA1 connections down
2013/05/30 13:29:53 critical ha	datapla 0  HA Group 1: Dataplane is down
2013/05/30 13:29:53 critical ha	state-c 0  HA Group 1: Moved from state Active to state Non-Functional
2013/05/30 13:29:54 critical ha	ha2-lin 0  HA2 link down
2013/05/30 13:29:54 critical ha	ha2-lin 0  All HA2 links down
2013/05/30 13:29:54 critical general	general 0  The dataplane is restarting.
2013/05/30 13:29:57 critical ha	ha1-lin 0  HA1 link down
2013/05/30 13:29:57 critical ha	ha1-lin 0  All HA1 links down
2013/05/30 13:30:00 critical general	general 0  Chassis Master Alarm: HA-event
2013/05/30 13:36:45 critical general	general 0  Chassis Master Alarm: Cleared

[panos]

can you type

show system files

and look if there is a crash information

[soporteseguridad]

admin@FW1(passive)> show system files

/var/cores/:

total 36M

-rw-r--r-- 1 root root  15M Apr  2 13:16 useridd_5.0.3_0.tar.gz

drwxrwxrwx 2 root root 4.0K Apr 25 16:21 crashinfo

-rw-r--r-- 1 root root  21M Apr 25 16:32 websrvr_5.0.3_0.tar.gz

/var/cores/crashinfo:

total 32K

-rw-rw-rw- 1 root root  18K Apr  2 13:02 useridd_5.0.3_0.info

-rw-rw-rw- 1 root root 9.9K Apr 25 16:21 websrvr_5.0.3_0.info

/opt/dpfs/var/cores/:

total 5.4M

drwxrwxrwx 2 root root 4.0K May 30 13:29 old

-rw-rw-rw- 1 root root 6.2M May 30 13:30 core.926

-rw-rw-rw- 1 root root 6.2M May 30 13:30 core.936

drwxrwxrwx 2 root root 4.0K May 30 13:31 crashinfo

-rw-r--r-- 1 root root 322K May 30 13:45 flow_mgmt_5.0.3_0.tar.gz

-rw-r--r-- 1 root root 1.5M May 30 13:45 pktproc_n_log_5.0.3_0.tar.gz

-rw-r--r-- 1 root root 365K May 30 13:45 mprelay_5.0.3_0.tar.gz

/opt/dpfs/var/cores/old:

total 2.3M

-rw-rw-rw- 1 root root 5.2M May 30 13:29 core.918

/opt/dpfs/var/cores/crashinfo:

total 28K

-rw-r--r-- 1 root root   24 May 30 13:30 pktproc_n_log_5.0.3_0.pcap

-rw-r--r-- 1 root root   24 May 30 13:30 flow_mgmt_5.0.3_0.pcap

-rw-rw-rw- 1 root root 3.6K May 30 13:31 mprelay_5.0.3_0.info

-rw-rw-rw- 1 root root 7.8K May 30 13:31 pktproc_n_log_5.0.3_0.info

-rw-rw-rw- 1 root root 5.0K May 30 13:32 flow_mgmt_5.0.3_0.info

[panos]

You have to open a case for that.Crashes not related to that time but I advise you to upgrade software 5.0.5 since there are many bug which is fixed related to restart problems.

[gswcowboy]

Those core files for the DP processes would provide insight as to what may have caused the restart. We would need to analyze them and attempt to cross refer to any known bugs fixed in 5.0.4 or 5.0.5 respectively. Best recourse to help determine root cause would be to open a case with Support or your Reseller.