Higher Management CPU post upgrade to 7.0.4

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Higher Management CPU post upgrade to 7.0.4

L6 Presenter

I've got a 5060 A/P pair that was running 6.1.4.


We are/were doing :


SSL forward Intercept

SSL Mirror

7 AD Group Mappings

Transparent Captive Portal



Pre-upgrade our MGMT CPU was around 20%.  Post upgrade to 7.0.4 we're 70%.  There have been no reports of issues by users and I haven't noticed any impacts from response in the UI.


My question was has anyone else noticed an increase in the MGMT CPU?  I'm guessing the increase has come from the redesign of ACC with the new ACE functionality, but haven't really investigated, yet.


@syadav A co-worker of mine IMs me today and says "hey, did you know there's a wide open PCAP that's been running?"


For a period of time unknown to me someone turned PCAP on w/o any filters.  I'm pretty much the day-to-day admin of our Palo enviornment with two other really knowledageable people providing assistance when necessary.  There are some other, less knowledgeable people on our team that have access to the FW, and I'm guessing one of them accidently turned it on w/o realizing it.


It just never occured to me that someone would actually leave on a setting w/such a blatant performance warning.


Post turning the PCAP off Management CPU is down to around 10/15%.



On a related note, I looked through the System and Configration logs and I can't find any record of any modification of the PCAP settings do you know if there's someway to track that change history?

@Brandon_Wertz...seems I was spot on ! 😉

 Regarding pcap log, On top of my head, I dont remember any particular log file which would log the pcap setting but following comand can be used to see the realtime setting :



admin@PA-VM> debug dataplane packet-diag show setting



Packet diagnosis setting:


Packet filter

  Enabled:                   no

  Match pre-parsed packet:   no            



  Enabled:                   no

  Log-throttle:              no

  Sync-log-by-ticks:         yes            




Packet capture                                                                                             <<<<<<<<<<<<<<<<

  Enabled:                   no

  Snaplen:                   0            




A painful way of achieving this would be writing a script and fetching this output periodically.





Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!