Long commit times when changing DNS settings

[s0lselcia]

On an HA pair of PA-460, the commit time is usually around 60 seconds, when changing the DNS settings to something that is not reachable, the commit time changes to 10 minutes+. I've tried replacing the primary but the issue is the same. When I looked at the device server logs there was a continual message with the number incrementing:

debug: pan_tdb_threat_id_hash_find(pan_tcomp_tdb.c:4391): threat_id_hash tid 94952 not found, is it ignored?

and

debug: pan_profile_comp_add_tahash(pan_profile_comp.c:3344): mlav profile_tahsh_insert with tid 52121, appid 0 action 0x300c

This seems to be going through all the threat IDs and maybe this is the reason that the commit has slowed down? If so is there a setting to disable these checks? or speed up the commit time?

[BPry]

@s0lselcia,

I'm not aware of any way to really modify how a commit processes without utilizing a commit force, which I don't believe would address this issue at all. Is there a reason why you're changing your DNS settings to servers that aren't accessible?

[s0lselcia]

Thanks for your response. I believe the cause is the EDLs. it's for when the internal network is not reachable, and external internet is not accessible.

[OtakarKlier]

Hello,

Do you have a lot of objects that are DNS based? Also in the logs, do you have the check box for resolve DNS checked?

Just thinking out loud.

Regards,