Virus install high CPU on Active, not standby?

[darren_g]

Hi.

Configuration : 2 x PA2020, Active/passive, running 4.1.11, trying to install AV release 957-1328

I noticed today while pushing a virus definition update that the active node in my active/standby takes an absolute age to install/update, with the management CPU running at 100% for most of the process, but the standby node not only finishes faster, it doesn't have nearly the CPU utilisation while this process is running.

For example, from today's job logs.

Standby node

Enqueued

ID

Type

Status Result Completed

--------------------------------------------------------------------------

2013/02/26 08:50:48	35	Antivirus	FIN	OK 09:03:05
2013/02/26 08:48:23	34	Install	FIN	OK 08:50:48
2013/02/25 12:08:48	33	HA-Sync	FIN	OK 12:10:42
2013/02/25 10:57:48	32	HA-Sync	FIN	OK 10:59:42
2013/02/23 20:20:40	31	Antivirus	FIN	OK 20:32:48
2013/02/23 20:18:58	30	Install	FIN	OK 20:20:41

Active node

Enqueued

ID

Type

Status Result Completed

--------------------------------------------------------------------------

2013/02/26 08:48:19	42	Antivirus	ACT   PEND	45%
2013/02/26 08:16:14	41	Install	FIN	OK 08:48:20
2013/02/26 08:15:12	40	Downld	FIN	OK 08:15:27
2013/02/25 12:01:13	39	Commit	FIN	OK 12:08:58
2013/02/25 10:50:10	38	Commit	FIN	OK 10:57:55
2013/02/23 20:18:55	37	Antivirus	FIN	OK 20:49:49
2013/02/23 20:00:49	36	Install	FIN	OK 20:18:55
2013/02/23 20:00:34	35	Downld	FIN	OK 20:00:46

Notice the difference in times - the passive node runs the install in about 15 minutes, the active node has now been running (time is approx 09:25:00) more than 35 minutes and is only at 45%.

Is anyone else seeing this? Is it expected behaviour? I can;t say I've ever seen the virus update take this long before I installed 4.1.11 - is this an issue in this release? I can roll back if necessary.

EDIT: I've just noticed that it's apparently not the virus install job causing this - the job is now finished, and the management CPU is still running at 100%. Any ideas? I can reboot, but I'd rather not just to fix a high management CPU use if I can avoid it.

Thanks

[darren_g · Accepted solution]

Never mind. I found other discussions which indicate this is a bug in 4.1.11 - rolling back to 4.1.10 now. Thank god for HA pairs.