High management cpu usage on PA-820 with PAN-OS 9.0.4

[grenzi]

Hello everybody,

  I know it is a faq already asked on the community forums, but in this case it is especially related to this particular configuration: PAN-OS 9.0.4 on a PA-820.

Starting from the day I installed 9.0.4 on this machine, I see the management cpu always at 100%; the top 5 processes with higher cpu usage are the httpd and four pan_task processes, and I can't figure out if it is a normal behavior or not. I remember that when running 8.1.x there was not such problem.

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND                                                                    
10539 nobody    20   0 2453580 176216   7956 S 198.7  4.3  10646:37 httpd                                                                      
 3505 root      20   0   75960  22496   7620 R 100.0  0.5  31708:51 pan_task                                                                   
 3506 root      20   0   50780   7868   6840 R 100.0  0.2  31708:41 pan_task                                                                   
 3507 root      20   0   51624   9448   7472 R 100.0  0.2  31707:54 pan_task                                                                   
 3508 root      20   0   51624   9572   7544 R 100.0  0.2  31708:54 pan_task  

The device is very low on network and resource usage, with as low as 10 users and less than 1000 cuncurrent sessions.

Is anybody experiencing the same issues with 9.0.4?

[kiwi]

Hi @grenzi ,

pan_task are the threads in the dataplane, where the packets are processed , and they will always show values like 99% or 100%. It is a correct value meaning that the dataplane is busy processing all the packets that it receives.

As for the high httpd load ... you can try to restart the process and verify if it slowly rises without dropping which could indicate a memory leak issue.

Cheers,

-Kiwi.

[grenzi]

Restarting the web-server process, as well all the management services, does not solve. I also removed all the EDL and reduced the logging. I'll try to downgrade to 8.1.

[grenzi]

Downgrading to 8.1.11 solved the high management cpu issue, now is 2% (instead of 100%).