reportd process function

[jasonrakers]

Anyone have some knowledge on what the reportd system process does?  Doing a "show system resources follow" from Panorama shows high utilization of this process.  I assumed reportd might be related to custom reports, we have 17 "scheduled" custom reports, but I can't find how to see when those reports are scheduled to be running.

[BPry · Accepted solution]

@jasonrakers,

reportd does the log queries alongside reports, and I know it interacts a bit with the Data Lake process. 

What version of PAN-OS are you running at the moment? There's a number of bug fixes which address issues with reportd depending on your current release. 

As for your scheduling question, go to the Device tab, and under management click on the settings icon on Logging And Reporting Settings. On the box that opens up, you'll want to navigate to the Log Export and Reporting tab and there's an option for Report Runtime.

[jasonrakers]

Awesome!  Thanks for the info on reports.   Running 8.1.15

[jasonrakers · Accepted solution]

I have an update on reportd.  After working with Palo Alto Support.  It was identified that the "Pre-Defined Reports" of our managed firewalls were the cause of our high reportd cpu time and slowness in Panorama GUI.  We disabled the pre-defined reports in our templates of the managed firewalls, and no more high cpu time for reportd, better responsiveness from Panorama GUI.    We saw a recurring hourly vm cpu spike, with the reports disabled for the managed firewalls, the recurring hourly cpu spike is no longer.

Here is an associated link from the knowledge base:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSvCAK