L3Svc process stopping automatically on PA-3020 firewall

[tamilvanan]

Hi Folks,

We are facing issue with the captive portal and had seen that the l3svc processor is not running. We had tried to restart the l3svc process and the mgmt plane process but no luck. our firewall was previously running on PAN-OS 9.1.13h3 and we had downgraded to 9.1.10 and checked but no luck.

We had rebooted the firewall again also. Checked the cord processor and could see the below logs on the file:

We suspect this might be an bug. Also seen crash files on the firewall.

Cord:

2021-12-21 13:45:55.290 +0530 ================CORD START=============
2021-12-21 13:45:55.290 +0530 succeed to initialize xslt security preference
2021-12-21 13:45:55.290 +0530 Running in 'FW' mode, cms_mode:0
2021-12-21 13:45:55.335 +0530 Setting throttle_on to 0 for mgmtsrvr @port 10000 in cord:cord
2021-12-21 13:45:55.335 +0530 Setting throttle_on to 0 for reportd in cord:cord
2021-12-21 13:45:55.345 +0530 Error: pan_mongo_connect(pan_mongo.c:101): mongo_client() failed:2
2021-12-21 13:45:55.345 +0530 Error: pan_corr_db_conn_connect(pan_corr_cdb.c:72): pan_mongo_connect() failed
2021-12-21 13:45:57.345 +0530 Error: pan_mongo_connect(pan_mongo.c:101): mongo_client() failed:2
2021-12-21 13:45:57.345 +0530 Error: pan_corr_db_conn_connect(pan_corr_cdb.c:72): pan_mongo_connect() failed
2021-12-21 13:45:59.346 +0530 Error: pan_mongo_connect(pan_mongo.c:101): mongo_client() failed:2
2021-12-21 13:45:59.346 +0530 Error: pan_corr_db_conn_connect(pan_corr_cdb.c:72): pan_mongo_connect() failed
2021-12-21 13:46:01.346 +0530 Error: pan_mongo_connect(pan_mongo.c:101): mongo_client() failed:2
2021-12-21 13:46:01.346 +0530 Error: pan_corr_db_conn_connect(pan_corr_cdb.c:72): pan_mongo_connect() failed
2021-12-21 13:46:03.349 +0530 debug: pan_corr_db_conn_connect(pan_corr_cdb.c:75): connected to database
2021-12-21 13:46:03.349 +0530 debug: pan_corr_db_connect(pan_corr_cdb.c:217): database initialized
2021-12-21 13:46:03.349 +0530 Corr DB initialized
2021-12-21 13:46:03.349 +0530 debug: pan_corr_db_init_table(pan_corr_db_tables.c:168): adding index correlation.dco_tracker table_name
2021-12-21 13:46:03.375 +0530 Error: pan_mongo_add_index_ex(pan_mongo.c:1216): mongo_create_simple_index() failed
2021-12-21 13:46:03.375 +0530 Error: pan_corr_db_init_table(pan_corr_db_tables.c:178): pan_mongo_add_index(correlation.dco_tracker table_name

admin@PA-3020-Primary(active)> show system software status

Slot 0, Role mp
----------------------------------------

Type Name State Info
Group all running
Group base running
Group batch running
Group batch_secondary running
Group chassis running
Group data_plane running
Group dsms running
Group fips running
Group gdb running
Group grp_plugins running
Group ha_ssh running
Group internal_monitor running
Group mgmt_services running
Group ntlm-grp running
Group services running
Group third_party running
Process authd running (pid: 5220)
Process cdb running (pid: 5418)
Process chasd running (pid: 3106)
Process cord running (pid: 4838)
Process crypto running (pid: 3635)
Process dagger running (pid: 3032)
Process devsrvr running (pid: 4839)
Process dhcp running (pid: 5216)
Process dnsproxy running (pid: 5217)
Process dp-console running (pid: 3146)
Process ehmon running (pid: 3105)
Process ha-sshd running (pid: 3662)
Process ha_agent running (pid: 5213)
Process ifmgr running (pid: 5210)
Process ikemgr running (pid: 5206)
Process keymgr running (pid: 5209)
Process l2ctrl running (pid: 5212)
Process l3svc stopped (pid: -1) - Exit Code: 1
Process logrcvr running (pid: 5207)
Process masterd running (pid: 2914)
Process mgmtsrvr running (pid: 3449)
Process monitor running (pid: 3033)
Process path_monitor running (pid: 11201)
Process pppoe running (pid: 5218)
Process rasmgr running (pid: 5208)
Process redis_useridd running (pid: 4950)
Process routed running (pid: 5219)
Process satd running (pid: 5214)
Process snmpd running (pid: 7278)
Process sshd running (pid: 3687)
Process sslmgr running (pid: 5215)
Process sslvpn running (pid: 9037)
Process sslvpn_ngx running (pid: 9049)

Thanks in advance.

[OtakarKlier]

Hello,

I would open a tac case. They can see more detail when you provide them with a tech support file.

Regards,

[Mamoudou]

hello, 

Any update about this issue ? I ha va the same in my firewall.