Turn off logging when high load on data plane

[jdprovine]

I think I read something that said you can configure the PA to shut off logging if the dataplane was running a very high percentage of load and I would also like to be sent an alert if anyone has any information on this process.

[pankaku]

If security policy have log at session start or/and log at session end then logging will happen regardless of log.

[TranceforLife]

Hi,

I don't think you can dynamically turn off logging, this is something that you are manually configuring either "on" or "off". Article below will help you to configure email alerts for the high DP utilisation etc:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Email-Alerts-for-System...

Thx,

Myky

[LCMember1959]

There is a setting under Setup -> Management -> Logging and Reporting Settings -> Log Export and Reporting called "Enable Log on High DP Load". Select this check box if you would like a system log entry generated when the packet processing load on the firewall is at 100% CPU utilization. Disabled by default. Is that what you were thinking of? I don't know of any way you can disable logging under high DP load, but at least this will alert you in case you don't have any other monitoring of your firewall..

[jdprovine]

Well when I think that the choice is enable log on High DP load it makes it sounds like it will continue to log even when the load is high and this was the definition on the machine. But I think this is close to what I was thinking, though my thought was that logging did not continue until the load on the DP reduced, so I am not sure

Enable Log on High DP Load—(Firewall only) Select this check box if you would like a system log entry generated when the packet processing load on the firewall is at 100% CPU utilization.
A high CPU load can cause operational degradation because the CPU does not have enough cycles to process all packets. The system log alerts you to this issue (a log entry is generated each minute) and allows you to investigate the probable cause.
Disabled by default.

[jvalentine]

I could be wrong here, but most of the logging functions happen on the MP, not the DP.  If you have 100% DP utilization, disabling logging probably won't do a whole lot to ease the problem.  

You're better off directly addressing the cause of high DP utilization, whether it be a DoS attack, applications being tagged as unknown-tcp/udp, using app-override where it makes sense, or looking at a larger platform with more DP resources.  

[jdprovine]

Thats a very good point, I just wish I could find the information that suggested it