high MP CPU load due to appweb3 process

Reply
Highlighted
L3 Networker

high MP CPU load due to appweb3 process

PA-5020, sitting on 8.0.4.

From time to time MP load increases rapadily due to appweb3 process going above 300%. Looking like this:

cpu-load.png

 

There is no direct correlation found between the spikes and actions taken within the GUI. Spike may go on for a while - 20 minutes, 2 hours, 5 hours, etc. During that time GUI is still usable and everything is operating without noticable delay (same goes for data plane, no impact there). But this is still bothering, as there's no clue what is causing the load and if that could have bigger impact for the box in the future.  

Spikes can be seen clearly when monitoring CPU load - it show values below 20% and then sudden spike ~90% further, while it drops after a while.

 

Has anyone seen such a behavior or are there any suggestion where to look further?

Highlighted
Community Team Member

Hi @nikoo,

 

This process has 3 instances with different names in MP (2 of them you can restart with the debug command).
You could try this and see if it alleviates the load :

> debug software restart process sslvpn-web-server
> debug software restart process web-server

 

More info on appweb3 :

 

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Determine-Which-Appweb-Process-needs...

 

Also this discussion on restarting appweb on PAN-OS 7.0 is still valid in 8.0 and might contain some useful tips :

 

https://live.paloaltonetworks.com/t5/General-Topics/Restart-appweb-in-PanOS-7-0-x/m-p/142861

 

Cheers !

-Kiwi.

Highlighted
L3 Networker

Hi,

 

Thanks for the input, I've looked though these articles and most likely reboot for these processes should be done anyway, but just curious if that is may be something specific customer is doing within GUI, etc. or that is process itself getting busy with something, so looking if someone has seen similar pattern in any way.

 

Highlighted
L2 Linker

Hi,

 

I dont't have access to the first link you mention. It says "You do not have sufficient privileges for this resource or its parent to perform this action."

 

kr,

 

Tommy

ACE8, PCNSE,PCNSC
PSE Platform Professional
PSE Endpoint Professional
Highlighted
L0 Member

this happened to our appliance rarely and the only command solve this is restart managment service 

 

 

>debug software restart process management-server 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!