Managment port flap

[CHOE-KyungJun]

Dear Team,

The mgmt port up/down phenomenon occurred from 00:07 to 00:08 on April 12.

I analyzed the tech support file and I found below log in the ms.log.

Is there any additional way I can check for cause analysis?

ms.log
2022-04-12 00:05:23.261 +0900 cmsa: peer watch. sock=50 curtime=2614507 recvtime=2614442 idx=0 proctime=2614442 sendtime=2614477 errcount=1
2022-04-12 00:05:36.550 +0900 lcs agent: peer watch. sock=53 curtime=2614520 recvtime=2614455 proctime=2614455 sendtime=2614490 errcount=1
2022-04-12 00:05:51.394 +0900 Warning: pan_hash_init(pan_hash.c:113): nbuckets 3 is not power of 2!
2022-04-12 00:05:51.394 +0900 Warning: pan_hash_init(pan_hash.c:113): nbuckets 10 is not power of 2!
2022-04-12 00:05:51.394 +0900 Warning: pan_hash_init(pan_hash.c:113): nbuckets 2000 is not power of 2!
2022-04-12 00:05:51.395 +0900 Warning: pan_hash_init(pan_hash.c:113): nbuckets 2000 is not power of 2!
2022-04-12 00:05:51.395 +0900 Warning: pan_hash_init(pan_hash.c:113): nbuckets 2000 is not power of 2!
2022-04-12 00:06:28.321 +0900 cmsa: peer watch. sock=50 curtime=2614572 recvtime=2614507 idx=0 proctime=2614442 sendtime=2614547 errcount=2
2022-04-12 00:06:41.610 +0900 lcs agent: peer watch. sock=53 curtime=2614585 recvtime=2614520 proctime=2614455 sendtime=2614560 errcount=2
2022-04-12 00:07:21.764 +0900 ### MS-DB: RuleHit update: /opt/pancfg/mgmt/devices/localhost.localdomain/rule-hit-count-db.txt
2022-04-12 00:07:33.381 +0900 Error: pan_cmsa_tcp_channel_loop(src_panos/cms_agent.c:1784): cmsa: peer timed out. sock=50 curtime=2614637 recvtime=2614572 idx=0 proctime=2614442 sendtime=2614617 errcount=3
2022-04-12 00:07:33.381 +0900 Drain thread type=1 total=0 match=0
2022-04-12 00:07:33.381 +0900 Drain thread type=1 total=0 match=0
2022-04-12 00:07:33.381 +0900 Drain thread type=1 total=0 match=0
2022-04-12 00:07:33.381 +0900 Drain thread type=1 total=0 match=0
2022-04-12 00:07:33.381 +0900 Drain thread type=1 total=0 match=0
2022-04-12 00:07:33.381 +0900 Drain thread type=1 total=0 match=0
2022-04-12 00:07:33.381 +0900 Drain thread type=1 total=0 match=0
2022-04-12 00:07:33.381 +0900 Drain thread type=1 total=0 match=0
2022-04-12 00:07:33.381 +0900 Drain thread type=1 total=0 match=0
2022-04-12 00:07:33.381 +0900 Drain thread type=1 total=0 match=0
2022-04-12 00:07:33.381 +0900 Drain thread type=2 total=0 match=0
2022-04-12 00:07:33.381 +0900 panorama agent: channel teardown. sock=50 idx=0
2022-04-12 00:07:33.381 +0900 panorama disconnected
2022-04-12 00:07:33.381 +0900 connmgr: shutdown channel. sock=50 ssl=0x555587e0b6c0
2022-04-12 00:07:33.387 +0900 connmgr: connection entry removed. devid=panorama sock=50 result=0
2022-04-12 00:07:33.387 +0900 MS: disconnected from panorama. waitcount=0
2022-04-12 00:07:33.389 +0900 panorama agent: channel teardown complete. idx=0
2022-04-12 00:07:33.481 +0900 logbuffer: log buffer thread: FW not registered to panorama, no log will be forwarded !
2022-04-12 00:07:33.481 +0900 pan_check_panorama_configured: find cms 0 addr = [10.182.64.38]

Thanks in advance,
Kyungjun,

[kiwi · Accepted solution]

Hi @CHOE-KyungJun ,

I'd recommend generating a tech support file of the device in question and send the file to TAC for analysis.  TAC can easily correlate all the different logs to a specific time-frame and link logs taking into account device state, resource usage, etc...

Cheers,

-Kiwi.

[CHOE-KyungJun]

Hi @kiwi 

CASE has been opened as further analysis is not possible with open documents and information.

I will update the results later

Cheers,
-kyungjun choe

[RajuLamichhane]

Hey CHOE,

Did you receive any update on above issue. Any suggestion on it? 

[CHOE-KyungJun · Accepted solution]

@RajuLamichhane 

Hi, RajuLamichhane

I opened the CASE and confirmed the issue as a problem with azure Therefore, it is recommended to check the peer side first before proceeding with the CASE.