System log message Clearing snmpd.log due to log overflow

[ChrisIsett]

I am wondering why I see the log 'Clearing snmpd.log due to log overflow' on several of my firewalls. Out of the ~20 firewalls I manage 2 or 3 firewalls log this message on occasion. The other firewalls never log this message.

I am trying to understand why this occurs on just a few firewalls. Should I be concerned about the message? What do I look for?

Chris

[Remo]

Hi @ChrisIsett 

What PAN-OS versions do you have installed on all these firewalls and are all the same firewalls or different ones? Do you monitor all these firewalls the same way?

[ChrisIsett]

Everything is 9.1.6. Panorama and Firewalls. They are all 5220's with the exception of one pair which are 5250's.

The snmp and logging configuration all gets pushed from templates. They are all basically monitored with the same set of tools. The firewalls are not under too.

I have looked at the health of the firewalls in Panorama and there is no obvious spike in traffic that seems to occur at the time the log message comes out.

[BPry]

@ChrisIsett,

The message in and of itself really isn't alarming, and it won't cause any traffic issues at all. If you feel up to a bit of troubleshooting and don't want to just open a ticket with TAC I would take a look at the actual log file via 'less mp-log snmpd.log' and see what is actually overflowing the log file. It's possible that these two endpoints were put into debug for some reason which can cause this message, or it could be something more serious. 

[ChrisIsett]

Thanks for the command. The log is literally full of this...

2021-08-14 11:25:25 truncating integer value > 32 bits

About 30 entries a minute. I checked the 2 f/w's that generate the snmpd log messages the most and they are just filled with the above message. The rest of the firewalls look normal.

A quick search did not reveal any hints on what the log message means.