Higher Management CPU post upgrade to 7.0.4

[Brandon_Wertz]

I've got a 5060 A/P pair that was running 6.1.4.

We are/were doing :

SSL forward Intercept

SSL Mirror

7 AD Group Mappings

Transparent Captive Portal

4 UIA

Pre-upgrade our MGMT CPU was around 20%.  Post upgrade to 7.0.4 we're 70%.  There have been no reports of issues by users and I haven't noticed any impacts from response in the UI.

My question was has anyone else noticed an increase in the MGMT CPU?  I'm guessing the increase has come from the redesign of ACC with the new ACE functionality, but haven't really investigated, yet.

[BenjAudy.MTL]

Hi,

Which process exactly is using that much CPU time ("show system resources follow" command in CLI)?

Benjamin

[Brandon_Wertz]

varrcvr

logrcvr

mgmtsrvr

Are the 3 ones hopping back and forth for top consuming CPU.

varrcvr using sometimes 120%+

[syadav · Accepted solution]

Hi Brandon,

varrcvr is usually responsible for URL logging and pcaps, do you have any pcaps enabled on the firewall by any chance ?

Also check for any core files :

> show system files

If the mgmt CPU hovers above 70% all the time, I would suggest opening a case with Technical support to investigate further.

[Gertjan-HFG]

Interesting on a PA500 wich is onder my administration, The average management cpu usage dropped 10% 

Where: doing inboud/outbound SSL decryption/ Full threat protection/pandb url filtering/4 UIA

The previous version was 6.1.8

[Brandon_Wertz]

@syadav A co-worker of mine IMs me today and says "hey, did you know there's a wide open PCAP that's been running?"

For a period of time unknown to me someone turned PCAP on w/o any filters.  I'm pretty much the day-to-day admin of our Palo enviornment with two other really knowledageable people providing assistance when necessary.  There are some other, less knowledgeable people on our team that have access to the FW, and I'm guessing one of them accidently turned it on w/o realizing it.

It just never occured to me that someone would actually leave on a setting w/such a blatant performance warning.

Post turning the PCAP off Management CPU is down to around 10/15%.

On a related note, I looked through the System and Configration logs and I can't find any record of any modification of the PCAP settings do you know if there's someway to track that change history?

[syadav]

@Brandon_Wertz...seems I was spot on ! 😉

 Regarding pcap log, On top of my head, I dont remember any particular log file which would log the pcap setting but following comand can be used to see the realtime setting :

admin@PA-VM> debug dataplane packet-diag show setting

--------------------------------------------------------------------------------

Packet diagnosis setting:

--------------------------------------------------------------------------------

Packet filter

  Enabled:                   no

  Match pre-parsed packet:   no            

--------------------------------------------------------------------------------

Logging

  Enabled:                   no

  Log-throttle:              no

  Sync-log-by-ticks:         yes            

  Features:

  Counters:

--------------------------------------------------------------------------------

Packet capture                                                                                             <<<<<<<<<<<<<<<<

  Enabled:                   no

  Snaplen:                   0            

--------------------------------------------------------------------------------

A painful way of achieving this would be writing a script and fetching this output periodically.