PA-5050-Data plane showing high

cancel
Showing results for 
Search instead for 
Did you mean: 

PA-5050-Data plane showing high

L2 Linker

Dear Team,

 

Our Core firewall Data plane  CPU reaching to 99% , When we checking the traffic logs some MS-SQL application getting high usage, and system logs are showing "dataplane under severe load palo alto".

 

Pan os : 8.1.15-h3 ,Device : PA 5050.

 

Kindly let us know any solutions for this.

 

Reagrds,

Vishnu.

 

 

6 REPLIES 6

Cyber Elite
Cyber Elite

@VishnuPS,

Kind of sounds like you've already done the investigation and found out what traffic is causing your increased Dataplane usage. So is this a new process, was there a recent update, are you questioning if the Dataplane should actually be running that high? 

kindly go through session statistic when data CPU reaches up to 99%.

Packet rate : 168808/s
Throughput : 454239 Kbps
Total active sessions : 245723
Active TCP sessions : 189741
Active UDP sessions : 47866
Active ICMP sessions : 2954

 

The session count is showing 2.45 lakh and device is having capacity 16lakh hence is that box not having that much capacity

 

Regards,

Vishnu 

Cyber Elite
Cyber Elite

@VishnuPS,

There's a lot more to dataplane usage than just session stats and throughput. Why did you initially mention SQL traffic in your original post, what was pointing you towards that traffic?

What do your pools like like? You could be running into a pool depletion issue, and if that's the case you can match it against resource-monitor. 

We have using IP-based policies, let me collect some more logs.

 

Also please mention what logs are we need to collect for dataplane CPU usage?

 

Regards,

Vishnu PS.

Cyber Elite
Cyber Elite

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRTCA0

 

@VishnuPS,

Start with the above linked document, and I would recommend reaching out to TAC to have them walk through this process with you if this is the first time you are having to troubleshoot this issue. 

Yes, We have tried to implement app override for ms-sql application, issue still the same. We are working with TAC.

 

I Will update here once we got any solution.

 

Thank you

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!