Higher Management CPU post upgrade to 7.0.4

cancel
Showing results for 
Search instead for 
Did you mean: 

Higher Management CPU post upgrade to 7.0.4

Cyber Elite
Cyber Elite

I've got a 5060 A/P pair that was running 6.1.4.

 

We are/were doing :

 

SSL forward Intercept

SSL Mirror

7 AD Group Mappings

Transparent Captive Portal

4 UIA

 

Pre-upgrade our MGMT CPU was around 20%.  Post upgrade to 7.0.4 we're 70%.  There have been no reports of issues by users and I haven't noticed any impacts from response in the UI.

 

My question was has anyone else noticed an increase in the MGMT CPU?  I'm guessing the increase has come from the redesign of ACC with the new ACE functionality, but haven't really investigated, yet.

1 ACCEPTED SOLUTION

Accepted Solutions

Hi Brandon,

 

varrcvr is usually responsible for URL logging and pcaps, do you have any pcaps enabled on the firewall by any chance ?

Also check for any core files :

> show system files

 

If the mgmt CPU hovers above 70% all the time, I would suggest opening a case with Technical support to investigate further.

 

 

 

View solution in original post

6 REPLIES 6

L4 Transporter

Hi,

 

Which process exactly is using that much CPU time ("show system resources follow" command in CLI)?

 

Benjamin

varrcvr

logrcvr

mgmtsrvr

 

Are the 3 ones hopping back and forth for top consuming CPU.

 

varrcvr using sometimes 120%+

Hi Brandon,

 

varrcvr is usually responsible for URL logging and pcaps, do you have any pcaps enabled on the firewall by any chance ?

Also check for any core files :

> show system files

 

If the mgmt CPU hovers above 70% all the time, I would suggest opening a case with Technical support to investigate further.

 

 

 

View solution in original post

L3 Networker

Interesting on a PA500 wich is onder my administration, The average management cpu usage dropped 10% 

Where: doing inboud/outbound SSL decryption/ Full threat protection/pandb url filtering/4 UIA

The previous version was 6.1.8

pa500-cpu.png

@syadav A co-worker of mine IMs me today and says "hey, did you know there's a wide open PCAP that's been running?"

 

For a period of time unknown to me someone turned PCAP on w/o any filters.  I'm pretty much the day-to-day admin of our Palo enviornment with two other really knowledageable people providing assistance when necessary.  There are some other, less knowledgeable people on our team that have access to the FW, and I'm guessing one of them accidently turned it on w/o realizing it.

 

It just never occured to me that someone would actually leave on a setting w/such a blatant performance warning.

 

Post turning the PCAP off Management CPU is down to around 10/15%.

 

 

On a related note, I looked through the System and Configration logs and I can't find any record of any modification of the PCAP settings do you know if there's someway to track that change history?

@Brandon_Wertz...seems I was spot on ! 😉

 Regarding pcap log, On top of my head, I dont remember any particular log file which would log the pcap setting but following comand can be used to see the realtime setting :

 

 

admin@PA-VM> debug dataplane packet-diag show setting

 

--------------------------------------------------------------------------------

Packet diagnosis setting:

--------------------------------------------------------------------------------

Packet filter

  Enabled:                   no

  Match pre-parsed packet:   no            

--------------------------------------------------------------------------------

Logging

  Enabled:                   no

  Log-throttle:              no

  Sync-log-by-ticks:         yes            

  Features:

  Counters:

--------------------------------------------------------------------------------

Packet capture                                                                                             <<<<<<<<<<<<<<<<

  Enabled:                   no

  Snaplen:                   0            

--------------------------------------------------------------------------------

 

 

A painful way of achieving this would be writing a script and fetching this output periodically.

 

 

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!