Higher Management CPU post upgrade to 7.0.4

[Brandon_Wertz]

I've got a 5060 A/P pair that was running 6.1.4.

We are/were doing :

SSL forward Intercept

SSL Mirror

7 AD Group Mappings

Transparent Captive Portal

4 UIA

Pre-upgrade our MGMT CPU was around 20%.  Post upgrade to 7.0.4 we're 70%.  There have been no reports of issues by users and I haven't noticed any impacts from response in the UI.

My question was has anyone else noticed an increase in the MGMT CPU?  I'm guessing the increase has come from the redesign of ACC with the new ACE functionality, but haven't really investigated, yet.

[Brandon_Wertz]

@syadav A co-worker of mine IMs me today and says "hey, did you know there's a wide open PCAP that's been running?"

For a period of time unknown to me someone turned PCAP on w/o any filters.  I'm pretty much the day-to-day admin of our Palo enviornment with two other really knowledageable people providing assistance when necessary.  There are some other, less knowledgeable people on our team that have access to the FW, and I'm guessing one of them accidently turned it on w/o realizing it.

It just never occured to me that someone would actually leave on a setting w/such a blatant performance warning.

Post turning the PCAP off Management CPU is down to around 10/15%.

On a related note, I looked through the System and Configration logs and I can't find any record of any modification of the PCAP settings do you know if there's someway to track that change history?

[syadav]

@Brandon_Wertz...seems I was spot on ! 😉

 Regarding pcap log, On top of my head, I dont remember any particular log file which would log the pcap setting but following comand can be used to see the realtime setting :

admin@PA-VM> debug dataplane packet-diag show setting

--------------------------------------------------------------------------------

Packet diagnosis setting:

--------------------------------------------------------------------------------

Packet filter

  Enabled:                   no

  Match pre-parsed packet:   no            

--------------------------------------------------------------------------------

Logging

  Enabled:                   no

  Log-throttle:              no

  Sync-log-by-ticks:         yes            

  Features:

  Counters:

--------------------------------------------------------------------------------

Packet capture                                                                                             <<<<<<<<<<<<<<<<

  Enabled:                   no

  Snaplen:                   0            

--------------------------------------------------------------------------------

A painful way of achieving this would be writing a script and fetching this output periodically.