What do 'SML VM Checks' and 'Detector Threats' do?

[KiCheon.Lee]

Hello

What do  'SML VM Checks' and 'Detector Threats' do in software pool?

These value was 1 when delayed to connect Web-Server.

Connection is normal when these value was high.

What do theses do? and what something do these influence FW?

Thanks

[kprakash]

There are functions related to content and threat detection. What is the version on the firewall?

BR,

Karthik

[Chatri]

Detector threat pool is responsible for correlating the pattern matches ( on traffic that has been decoded by the content engine of the FW) and the action set. This is in a nut shell is responsible for alerting on any matched threat signatures.

[KiCheon.Lee]

This version is 5.0.4

[kprakash]

Did you experience a latency in the traffic, when you saw the counters drop to this value? Can you elaborate more about that you meant by "delayed to connect Web-Server",

Can you try configuring the DSRI option on the firewall as mentioned in the below links, to see if it makes a difference.

https://live.paloaltonetworks.com/message/21078#21078

https://live.paloaltonetworks.com/docs/DOC-3821

Threat Prevention performance will not be impacted by the number of Threat Prevention profiles or the number of signatures that are enabled thanks to the single pass parallel processing architecture (SP3) unique to the Palo Alto

Networks firewall. Any session content is inspected in parallel by the Antivirus, Anti-Spyware and Vulnerability Protection features. One notable configuration setting that will have a positive impact on performance is DSRI or Disable Server

Response Inspection. With DSRI turned on, server response traffic is not inspected, which will increase the throughput capacity. Obviously, enabling this feature is only recommended for trusted servers.

Best regards,

Karthik