12-17-2021 02:30 AM - edited 12-17-2021 02:35 AM
Hi Team,
The l3svc process is restarting automatically whenever we are doing an commit on the firewall.
This is sometime causing captive portal to not work correctly.
Is this an bug. We are having PAN-OS 9.1.10 currently installed on the firewall and the firewall is active in Active/Passive HA mode and the firewall model is PA-3220.
| masterd.log | 2021-12-16 18:49:17.771 +0530 INFO: l3svc: received user restart |
| masterd.log | 2021-12-16 18:49:17.771 +0530 INFO: l3svc: User restart reason - restart triggered by devsrvr commit |
| masterd.log | 2021-12-16 18:49:17.772 +0530 INFO: l3svc: received user stop |
| masterd.log | 2021-12-16 18:49:18.305 +0530 INFO: l3svc: exited, Core: False, Exit code: 0 |
| masterd.log | 2021-12-16 18:49:18.545 +0530 INFO: l3svc: process running with pid 10320 |
| masterd.log | 2021-12-16 18:50:41.904 +0530 INFO: l3svc: received user restart |
| masterd.log | 2021-12-16 18:50:41.904 +0530 INFO: l3svc: User restart reason - restart triggered by devsrvr commit |
| masterd.log | 2021-12-16 18:50:41.904 +0530 INFO: l3svc: received user stop |
| masterd.log | 2021-12-16 18:50:43.305 +0530 INFO: l3svc: exited, Core: False, Exit code: 0 |
| masterd.log | 2021-12-16 18:50:43.543 +0530 INFO: l3svc: process running with pid 11535 |
| masterd.log | 2021-12-16 18:54:40.645 +0530 INFO: l3svc: received user restart |
| masterd.log | 2021-12-16 18:54:40.645 +0530 INFO: l3svc: User restart reason - restart triggered by devsrvr commit |
| masterd.log | 2021-12-16 18:54:40.645 +0530 INFO: l3svc: received user stop |
| masterd.log | 2021-12-16 18:54:41.305 +0530 INFO: l3svc: exited, Core: False, Exit code: 0 |
| masterd.log | 2021-12-16 18:54:41.547 +0530 INFO: l3svc: process running with pid 13562 |
| masterd.log | 2021-12-16 18:56:50.907 +0530 INFO: l3svc: received user restart |
| masterd.log | 2021-12-16 18:56:50.907 +0530 INFO: l3svc: User restart reason - restart triggered by devsrvr commit |
| masterd.log | 2021-12-16 18:56:50.908 +0530 INFO: l3svc: received user stop |
| masterd.log | 2021-12-16 18:56:52.306 +0530 INFO: l3svc: exited, Core: False, Exit code: 0 |
| masterd.log | 2021-12-16 18:56:52.552 +0530 INFO: l3svc: process running with pid 15052 |
| masterd.log | 2021-12-17 10:43:18.299 +0530 INFO: l3svc: received user restart |
| masterd.log | 2021-12-17 10:43:18.300 +0530 INFO: l3svc: User restart reason - restart triggered by devsrvr commit |
| masterd.log | 2021-12-17 10:43:18.300 +0530 INFO: l3svc: received user stop |
| masterd.log | 2021-12-17 10:43:19.305 +0530 INFO: l3svc: exited, Core: False, Exit code: 0 |
| masterd.log | 2021-12-17 10:43:19.547 +0530 INFO: l3svc: process running with pid 22775 |
01-17-2022 12:23 PM
Hi there!
The very firs step I would recommend is to move to a "preferred" or stable release. 9.1.10 is not the recommended 9.1 release.
As of today, the preferred/recommended/stable 9.1 release is 9.1.12.
If you were to open a case with PANW Support, that's the first thing they would request I believe.
Since you are running an HA pair, I would follow the upgrade recommendations during a maintenance window.
PS:
"L3svc: Serves web pages for captive portal, NTLM authentication, URL admin override page and URL block page."
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLUeCAO
01-17-2022 02:46 PM
Hi,
As far as I know, this isn't a bug. l3svc just needs to restart on every commit.
It would be worth opening a case with TAC and reporting that this is causing a service interruption for you.
- DM
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
