useridd - virtual memory limit exceeded, restarting error

[rrau]

3000 Series FW running 6.0.4.  Getting this critical error every 20 mins.  Have a case open with TAC but no answers.  Anyone experience and know a fix?

[hshah]

Hi Rrau,

I didnt find any bug specific to 6.0.4 release.

Regards,

Hardik Shahax

[stunder_kareo]

I just received this same error.  It hasn't been repetitious yet.  Was TAC able to address the issue or did you find a work around?

[ajbool]

A workaround of disabling HA session synchronisation  between my Active/Active firewall pair has stopped useridd dying for me.

Are you both running Global Protect on these firewalls?

[stunder_kareo]

Yes I am actually running Global Protect my firewalls but I am not in Active/Active mode.  I haven't seen the error repeat itself yet today but will keep monitoring it.

[ssharma]

Hi Rrau,

It is known issue that we are actively trying to resolve. There are 2 workaround at the moment but they are bit radical :

1. Suspend the passive device if you are HA A/P mode

2. If you are not using HIP profiles, delete GP gateway license

To perform #2, you will need to :

admin@PA> delete license key <all_gp_gateway_key>

Reboot the device and do not fetch the license once rebooted. This needs to done on both device.

Like I said it is bit radical workaround while we are still looking for a permanent resolution. Thank you.

[ajbool]

What version of Global Protect are your clients using?

[ajbool]

Hi Ssharma,

Do you know if this issue has now been resolved in any released code?

Thanks!

[jochristian]

Hello,

This bug has been fixed in 6.0.6-h2.
It related to userid and hip according to support.

Ask your local ASC/support to activate 6.0.6-h2 for your devices, or wait for 6.0.7 that also have the fix.

/Jo Christian

[ajbool]

Hi Jo, many thanks for the info!