SYSTEM ALERT : critical : Out of memory condition detected, kill process 8000

[Didar_Bajwa]

We have two HA pair PA 5060 fw on PAN OS version 8.1.23, wherein the system logs, we see below OOM issue.

Device up time is 352 days.

SYSTEM ALERT : critical : Out of memory condition detected, kill process 8000

We have checked in the preferred releases for 8.1.* we don't see any publicly documented addressed OOM issues.

We do see some in the 9.1.* versions but we cannot move that far as of now.

2023-04-26 03:23:56.212 +0100  --- top >> 30726 root      20   0 2024m 152m 7968 S 153.2  3.9   4:58.15 mgmtsrvr  
2023-04-26 06:43:57.066 +0100  --- top >> 30726 root      20   0 2078m 215m 8064 S 98.7  5.5  14:26.21 mgmtsrvr
2023-04-26 09:03:57.912 +0100  --- top >> 30726 root      20   0 2078m 468m 8992 S 98.4 11.8  22:43.26 mgmtsrvr  
2023-04-26 13:23:59.597 +0100  --- top >> 30726 root      20   0 2095m 533m 8796 S 98.6 13.5  36:16.69 mgmtsrvr 
2023-04-26 13:43:59.630 +0100  --- top >> 30726 root      20   0 2174m 814m 9220 S 100.4 20.6  38:34.87 mgmtsrvr

Please advise what can be done to get this retified.

Are there any documented bugs which suggest a upgrade is needed?

Do we have to restart the mgmtserver and devsrvr processes on the firewalls?

@Param_Upadhyay 

@UtkarshKumar 

[BPry]

@Didar_Bajwa,

I would really recommend that you upgrade to 8.1.24-h1 if you're going to stick on 8.1 to address CVE-2022-0030 authentication bypass. The benefit of the install is that you'll also restart the device so you don't have such a high uptime as well, seeing as there's the potential that having that much uptime is ultimately causing the OOM condition in the first place. 

[Didar_Bajwa]

@BPry We rebooted the device but again got the same error. Also, we dont want to upgrade as further upgrades dont specifically mention anything publicly that they have addresses any OOM issues.. do you have any other sugesstion which we can try

[reaper]

There's a new 8.1.25 release which i would recommend you upgrade to

8.1 is no longer officially supported so release notes will be limited to "This release includes bug and performance fixes."