PA-5050-Data plane showing high

[VishnuPS]

Dear Team,

Our Core firewall Data plane  CPU reaching to 99% , When we checking the traffic logs some MS-SQL application getting high usage, and system logs are showing "dataplane under severe load palo alto".

Pan os : 8.1.15-h3 ,Device : PA 5050.

Kindly let us know any solutions for this.

Reagrds,

Vishnu.

[BPry]

@VishnuPS,

Kind of sounds like you've already done the investigation and found out what traffic is causing your increased Dataplane usage. So is this a new process, was there a recent update, are you questioning if the Dataplane should actually be running that high? 

[VishnuPS]

kindly go through session statistic when data CPU reaches up to 99%.

Packet rate : 168808/s
Throughput : 454239 Kbps
Total active sessions : 245723
Active TCP sessions : 189741
Active UDP sessions : 47866
Active ICMP sessions : 2954

The session count is showing 2.45 lakh and device is having capacity 16lakh hence is that box not having that much capacity

Regards,

Vishnu 

[BPry]

@VishnuPS,

There's a lot more to dataplane usage than just session stats and throughput. Why did you initially mention SQL traffic in your original post, what was pointing you towards that traffic?

What do your pools like like? You could be running into a pool depletion issue, and if that's the case you can match it against resource-monitor. 

[VishnuPS]

We have using IP-based policies, let me collect some more logs.

Also please mention what logs are we need to collect for dataplane CPU usage?

Regards,

Vishnu PS.

[BPry]

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRTCA0

@VishnuPS,

Start with the above linked document, and I would recommend reaching out to TAC to have them walk through this process with you if this is the first time you are having to troubleshoot this issue. 

[VishnuPS]

Yes, We have tried to implement app override for ms-sql application, issue still the same. We are working with TAC.

I Will update here once we got any solution.

Thank you