SYSTEM ALERT : high : Not enough space to load conent to SHM after upgrading PA820 to PanOS 10.0.3

[idelconsulting]

Dear all.

I upgraded last night to PanOS 10.0.3 and this morning I'm getting error messages from the firewall:

SYSTEM ALERT : high : Not enough space to load conent to SHM

admin@xxx> show system disk-space

Filesystem Size Used Avail Use% Mounted on
/dev/root 9.5G 2.7G 6.4G 30% /
none 2.0G 68K 2.0G 1% /dev
/dev/sda5 19G 4.1G 14G 23% /opt/pancfg
/dev/sda6 7.6G 2.0G 5.2G 29% /opt/panrepo
tmpfs 2.0G 2.0G 4.7M 100% /dev/shm
cgroup_root 2.0G 0 2.0G 0% /cgroup
/dev/sda8 172G 115G 48G 71% /opt/panlogs

tmpfs is indeed full.

All the usual recommendations around full disk are about other partitions.

Anybody seen similar issues?

Regards,

    Andreas

[SureshReddyM]

Hi,

Can you try as per below KB.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS

try to clean temporary files and not imp files to spare disk usage.

Best Regards,

Suresh

[idelconsulting]

Hi Suresh,

This seems to be a different situation.

Normal file systems are fine.

It is just a problem with tmpfs

Regards,

    Andreas

[MP18]

@idelconsulting 

You might need to open tac case for this as they might need to delete some files from root

Regards

[MP18]

@idelconsulting 

Also this should not cause any performance issues on the PA.

Are you experiencing any issue on PA due to this?

Seems tmpfs is a temporary partition in PA.

Try a reboot

Regards

[idelconsulting]

Hi MP18,

I have a TAC case open but so far not much info.

Initially these messages disappeared after a while, but today they resurfaced.

Seems to be kind of a pattern.

Not sure about the impact:

Will ask TAC again what exactly this means and the possible impact: Not enough space to load conent to SHM

Receive Time	Type	Config Version	Generate Time	Severity	Description
2021/02/02 08:03:22	SYSTEM	0	2021/02/02 08:03:22	high	Not enough space to load conent to SHM
2021/02/02 07:43:18	SYSTEM	0	2021/02/02 07:43:18	high	Not enough space to load conent to SHM
2021/02/02 07:23:30	SYSTEM	0	2021/02/02 07:23:30	high	Not enough space to load conent to SHM
2021/02/02 07:03:08	SYSTEM	0	2021/02/02 07:03:08	high	Not enough space to load conent to SHM
2021/02/02 06:43:14	SYSTEM	0	2021/02/02 06:43:14	high	Not enough space to load conent to SHM
2021/02/02 05:08:32	SYSTEM	0	2021/02/02 05:08:32	high	Not enough space to load conent to SHM
2021/02/02 04:28:11	SYSTEM	0	2021/02/02 04:28:11	high	Not enough space to load conent to SHM
2021/02/02 03:53:13	SYSTEM	0	2021/02/02 03:53:13	high	Not enough space to load conent to SHM
2021/02/02 03:33:17	SYSTEM	0	2021/02/02 03:33:17	high	Not enough space to load conent to SHM
2021/02/02 03:13:09	SYSTEM	0	2021/02/02 03:13:09	high	Not enough space to load conent to SHM
2021/02/02 02:53:29	SYSTEM	0	2021/02/02 02:53:29	high	Not enough space to load conent to SHM
2021/02/02 02:33:28	SYSTEM	0	2021/02/02 02:33:28	high	Not enough space to load conent to SHM
2021/02/02 02:18:14	SYSTEM	0	2021/02/02 02:18:14	high	Not enough space to load conent to SHM
2021/02/02 01:58:11	SYSTEM	0	2021/02/02 01:58:11	high	Not enough space to load conent to SHM
2021/02/02 01:38:26	SYSTEM	0	2021/02/02 01:38:26	high	Not enough space to load conent to SHM
2021/02/02 01:18:19	SYSTEM	0	2021/02/02 01:18:19	high	Not enough space to load conent to SHM
2021/02/02 00:58:29	SYSTEM	0	2021/02/02 00:58:29	high	Not enough space to load conent to SHM
2021/02/02 00:38:21	SYSTEM	0	2021/02/02 00:38:21	high	Not enough space to load conent to SHM
2021/01/31 12:08:25	SYSTEM	0	2021/01/31 12:08:25	high	Not enough space to load conent to SHM
2021/01/31 11:48:14	SYSTEM	0	2021/01/31 11:48:14	high	Not enough space to load conent to SHM
2021/01/31 11:28:23	SYSTEM	0	2021/01/31 11:28:23	high	Not enough space to load conent to SHM
2021/01/31 11:08:25	SYSTEM	0	2021/01/31 11:08:25	high	Not enough space to load conent to SHM
2021/01/31 10:18:21	SYSTEM	0	2021/01/31 10:18:21	high	Not enough space to load conent to SHM
2021/01/31 09:58:21	SYSTEM	0	2021/01/31 09:58:21	high	Not enough space to load conent to SHM
2021/01/31 09:08:30	SYSTEM	0	2021/01/31 09:08:30	high	Not enough space to load conent to SHM
2021/01/31 08:48:10	SYSTEM	0	2021/01/31 08:48:10	high	Not enough space to load conent to SHM
2021/01/31 08:28:25	SYSTEM	0	2021/01/31 08:28:25	high	Not enough space to load conent to SHM
2021/01/31 07:23:25	SYSTEM	0	2021/01/31 07:23:25	high	Not enough space to load conent to SHM
2021/01/31 07:03:21	SYSTEM	0	2021/01/31 07:03:21	high	Not enough space to load conent to SHM
2021/01/31 06:43:22	SYSTEM	0	2021/01/31 06:43:22	high	Not enough space to load conent to SHM
2021/01/31 06:23:36	SYSTEM	0	2021/01/31 06:23:36	high	Not enough space to load conent to SHM
2021/01/31 06:03:21	SYSTEM	0	2021/01/31 06:03:21	high	Not enough space to load conent to SHM
2021/01/31 05:43:10	SYSTEM	0	2021/01/31 05:43:10	high	Not enough space to load conent to SHM
2021/01/31 05:23:26	SYSTEM	0	2021/01/31 05:23:26	high	Not enough space to load conent to SHM
2021/01/31 05:03:24	SYSTEM	0	2021/01/31 05:03:24	high	Not enough space to load conent to SHM
2021/01/31 04:43:16	SYSTEM	0	2021/01/31 04:43:16	high	Not enough space to load conent to SHM

Regards,

    Andreas

[idelconsulting]

Hi,

I have a TAC case open but so far didn't receive any details about the potential impact.

initially the messages disappeared, but resurfaced again today.

Seems to be some kind of a pattern.

I'll chase TAC for the possible impact.

Receive Time	Type	Config Version	Generate Time	Severity	Description
2021/02/02 08:03:22	SYSTEM	0	2021/02/02 08:03:22	high	Not enough space to load conent to SHM
2021/02/02 07:43:18	SYSTEM	0	2021/02/02 07:43:18	high	Not enough space to load conent to SHM
2021/02/02 07:23:30	SYSTEM	0	2021/02/02 07:23:30	high	Not enough space to load conent to SHM
2021/02/02 07:03:08	SYSTEM	0	2021/02/02 07:03:08	high	Not enough space to load conent to SHM
2021/02/02 06:43:14	SYSTEM	0	2021/02/02 06:43:14	high	Not enough space to load conent to SHM
2021/02/02 05:08:32	SYSTEM	0	2021/02/02 05:08:32	high	Not enough space to load conent to SHM
2021/02/02 04:28:11	SYSTEM	0	2021/02/02 04:28:11	high	Not enough space to load conent to SHM
2021/02/02 03:53:13	SYSTEM	0	2021/02/02 03:53:13	high	Not enough space to load conent to SHM
2021/02/02 03:33:17	SYSTEM	0	2021/02/02 03:33:17	high	Not enough space to load conent to SHM
2021/02/02 03:13:09	SYSTEM	0	2021/02/02 03:13:09	high	Not enough space to load conent to SHM
2021/02/02 02:53:29	SYSTEM	0	2021/02/02 02:53:29	high	Not enough space to load conent to SHM
2021/02/02 02:33:28	SYSTEM	0	2021/02/02 02:33:28	high	Not enough space to load conent to SHM
2021/02/02 02:18:14	SYSTEM	0	2021/02/02 02:18:14	high	Not enough space to load conent to SHM
2021/02/02 01:58:11	SYSTEM	0	2021/02/02 01:58:11	high	Not enough space to load conent to SHM
2021/02/02 01:38:26	SYSTEM	0	2021/02/02 01:38:26	high	Not enough space to load conent to SHM
2021/02/02 01:18:19	SYSTEM	0	2021/02/02 01:18:19	high	Not enough space to load conent to SHM
2021/02/02 00:58:29	SYSTEM	0	2021/02/02 00:58:29	high	Not enough space to load conent to SHM
2021/02/02 00:38:21	SYSTEM	0	2021/02/02 00:38:21	high	Not enough space to load conent to SHM
2021/01/31 12:08:25	SYSTEM	0	2021/01/31 12:08:25	high	Not enough space to load conent to SHM
2021/01/31 11:48:14	SYSTEM	0	2021/01/31 11:48:14	high	Not enough space to load conent to SHM
2021/01/31 11:28:23	SYSTEM	0	2021/01/31 11:28:23	high	Not enough space to load conent to SHM
2021/01/31 11:08:25	SYSTEM	0	2021/01/31 11:08:25	high	Not enough space to load conent to SHM
2021/01/31 10:18:21	SYSTEM	0	2021/01/31 10:18:21	high	Not enough space to load conent to SHM
2021/01/31 09:58:21	SYSTEM	0	2021/01/31 09:58:21	high	Not enough space to load conent to SHM
2021/01/31 09:08:30	SYSTEM	0	2021/01/31 09:08:30	high	Not enough space to load conent to SHM
2021/01/31 08:48:10	SYSTEM	0	2021/01/31 08:48:10	high	Not enough space to load conent to SHM
2021/01/31 08:28:25	SYSTEM	0	2021/01/31 08:28:25	high	Not enough space to load conent to SHM
2021/01/31 07:23:25	SYSTEM	0	2021/01/31 07:23:25	high	Not enough space to load conent to SHM
2021/01/31 07:03:21	SYSTEM	0	2021/01/31 07:03:21	high	Not enough space to load conent to SHM
2021/01/31 06:43:22	SYSTEM	0	2021/01/31 06:43:22	high	Not enough space to load conent to SHM
2021/01/31 06:23:36	SYSTEM	0	2021/01/31 06:23:36	high	Not enough space to load conent to SHM
2021/01/31 06:03:21	SYSTEM	0	2021/01/31 06:03:21	high	Not enough space to load conent to SHM
2021/01/31 05:43:10	SYSTEM	0	2021/01/31 05:43:10	high	Not enough space to load conent to SHM
2021/01/31 05:23:26	SYSTEM	0	2021/01/31 05:23:26	high	Not enough space to load conent to SHM
2021/01/31 05:03:24	SYSTEM	0	2021/01/31 05:03:24	high	Not enough space to load conent to SHM
2021/01/31 04:43:16	SYSTEM	0	2021/01/31 04:43:16	high	Not enough space to load conent to SHM

Regards,

   Andreas

[idelconsulting]

Quick update:

After upgrading to 10.0.4 these messages didn't come up again.

But I still didn't receive any update from TAC regarding a possible operational impact.

Looks like a typo. I assume it should say content and not conent.

Unfortunately unclear which content and what is the impact.

Regards,

   Andreas

[joachimtingvold]

I see these messages on 820 running 10.0.4.

[nikoo]

Hi,

Was there any conclusion from TAC regarding these message, impact and/or solution?

[idelconsulting]

TAC was saying that this could happen if new signatures are deployed while reports are still being generated depending on older signatures.

So basically the older signatures are kept around while the reports are generated and these are filling up the space.