high MP CPU load due to appweb3 process

[nikoo]

PA-5020, sitting on 8.0.4.

From time to time MP load increases rapadily due to appweb3 process going above 300%. Looking like this:

There is no direct correlation found between the spikes and actions taken within the GUI. Spike may go on for a while - 20 minutes, 2 hours, 5 hours, etc. During that time GUI is still usable and everything is operating without noticable delay (same goes for data plane, no impact there). But this is still bothering, as there's no clue what is causing the load and if that could have bigger impact for the box in the future.  

Spikes can be seen clearly when monitoring CPU load - it show values below 20% and then sudden spike ~90% further, while it drops after a while.

Has anyone seen such a behavior or are there any suggestion where to look further?

[kiwi]

Hi @nikoo,

This process has 3 instances with different names in MP (2 of them you can restart with the debug command).
You could try this and see if it alleviates the load :

> debug software restart process sslvpn-web-server
> debug software restart process web-server

More info on appweb3 :

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Determine-Which-Appweb-Process-needs...

Also this discussion on restarting appweb on PAN-OS 7.0 is still valid in 8.0 and might contain some useful tips :

https://live.paloaltonetworks.com/t5/General-Topics/Restart-appweb-in-PanOS-7-0-x/m-p/142861

Cheers !

-Kiwi.

[nikoo]

Hi,

Thanks for the input, I've looked though these articles and most likely reboot for these processes should be done anyway, but just curious if that is may be something specific customer is doing within GUI, etc. or that is process itself getting busy with something, so looking if someone has seen similar pattern in any way.

[tommyschoemans]

Hi,

I dont't have access to the first link you mention. It says "You do not have sufficient privileges for this resource or its parent to perform this action."

kr,

Tommy

[AbdallahMousa]

this happened to our appliance rarely and the only command solve this is restart managment service 

>debug software restart process management-server