resources-unavailable for DNS-base traffic

[adminglu]

Model: Palo Alto PA-3420
Software version: 11.2.4-h1

Most of our dns-base traffic has the "session end reason" resources-unavailable suddenly. We're also having trouble loading webpages. The resources-unavailable reason is only on DNS-base traffic and it is for DNS traffic to our 2 internal DNS servers, but also from our DNS-server to the forwarders or directly to external DNS server (for example 8.8.4.4, 8.8.8.8).

I checked the commands "show counter global name aho_alloc_lookup_failed":

Name:           aho_alloc_lookup_failed
Value:          0
Severity:       Warning
Category:       aho
Aspect:         resource
Description:    failed to alloc regex lookup

 And "debug dataplane pool statistics | match "Regex Results"":

[18] Regex Results (  16352): 2048/2048  52/2048  1/1      0xd301603b00-0xd3035f3b00  52

But that seems ok. Any suggestions what can be wrong, or where I can look?

[OtakarKlier]

Hello,

Check the unified logs to see where/if the traffic is getting blocked. Its UDP so might have to check the session browser, if the session is still open it wont show in the logs (reason 'log at session end' on the security policy).

Regards,

Regards,

[adminglu]

The traffic is allowed:

It seems like some sort of memory leak affecting only the DNS traffic. We had to restart the firewall because normal internet was impossible with all the failed DNS requests. After the reboot we haven't seen any "session end reason: resource-unavailable" anymore. The uptime before the reboot was 61 days, so not that long.

[MattSloan]

Any info on the cause? We've had this occur twice now, 14 days apart. A reboot was the only solution. I haven't opened a case yet, but that's my next step.

[mshekh]

Hi @adminglu ,

Recommendation is to open a support case and work with tac team to identify the issue.

[adminglu]

After 21 days uptime the issue came back. This friday I have to install an update on the firewall so the problem will be gone for a while. If it comes back again I'm going to create a support ticket with Palo Alto.