What is the effect of restarting device server on Data traffic?

[Gururaj]

Hi All,

What is the effect of restarting device server on Data traffic?

and also what is the difference between device server and management server? what is the effect in both ?

Regards,

Gururaj

[kfindlen · Accepted solution]

In the vast majority of cases restarting the device server or management server will not cause any impacts on traffic passing through the dataplane.  These two processes are major parts of the management plane processing on the device. 

The management server is the core process that is used to run the CLI, web UI, work with the configuration files, and perform most operations on the management plane through other processes.  The device server is used for communication between the MP and DP.  It's main job is to push configurations to the DP during the commit process and also service some requests coming from the DP such as URL categorization.

It might be best to schedule the restarts during a maintenance window to minimize impact.

[T.XuanDung]

How long does it usually take to restart process device-server ?

 

[kiwi]

Hi @T.XuanDung ,

When you restart the device-server process (debug software restart process device-server) on a PAN device, there’s no fixed “hard” time for how long it will take — it depends on the device model, current load, active sessions, HA state, etc. But some guidance and expected behaviour are documented:

According to this knowledgebase article about the “devsrvr” (device-server) process, when you restart it there will be temporary impact to certain management-plane functions (config push to dataplane, URL filtering requests, etc).  The article doesn’t quote a specific duration, but implies it’s “quick” in the context of just the process restart (not a full reboot). 

It should be quicker than a restart of the management-server process (mgmtsrvr), which usually takes a couple of minutes.

I’d recommend the following when you plan to restart device-server:

• Inform stakeholders: explain management-plane impact (not data-plane forwarding) but things like config pushes / logs / URL-filtering may be temporarily impacted.

• Choose a maintenance window or off‐peak time.

• After issuing debug software restart process device-server, monitor to confirm when the process is running again.

• In HA mode: Consider failing over or pausing Preemptive mode.

Hope this helps,

Kim.

[T.XuanDung]

@kiwi  I have one question : 

Is there a clear way to check for abnormalities in the device-server process using the GUI or command line?

[kiwi]

Hi @T.XuanDung ,

Yes absolutely, you can debug the device server.

It is explained very well by @reaper in the following discussion:

https://live.paloaltonetworks.com/t5/general-topics/what-does-devsrvr-daemon-operate/td-p/65520

You can check all the debug levels as explained in this KB:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCaRCAW

Hope this helps,

Kim.

[reaper]

just a few seconds usually

the management server will appear to take longer as it will also directly impact your connectivity (ssl or ssh) as an admin and kick you out when you restart it

[T.XuanDung]

Hi @kiwi  Thank you for your help. My point is: how can I know when the process is having an issue, for example when it’s hanging or not processing anything?
Example : I ran the command to check URL Filtering:
test url city.sakura.lg.jp
It returned: Server error: Failed to get response from device server. Please try again later.

Is there any way for me to know if the device server process is having an issue?

[T.XuanDung]

How can I know when the process is having an issue, for example when it’s hanging or not processing anything?
Example : I ran the command to check URL Filtering:
test url example.org
It returned: Server error: Failed to get response from device server. Please try again later.

Is there any way for me to know if the device server process is having an issue?

[reaper]

you can check if a daemion is still running with the following command:

show system software status 

you can troubleshoot if your system is 'struggling' with resources by running the following command to spot any daemon consuming too much resources

show system resources

[T.XuanDung]

daemon devsrvr is running and cpu, memory is normal but I ran the command to check URL Filtering:
test url city.sakura.lg.jp
It returned: Server error: Failed to get response from device server. Please try again later.

> show system software status

Slot 0, Role mp
----------------------------------------
Process devsrvr running (pid: 6974)

> show system resources

top - 13:37:08 up 101 days, 24 min, 1 user, load average: 0.25, 0.22, 0.15
Tasks: 246 total, 1 running, 245 sleeping, 0 stopped, 0 zombie
%Cpu(s): 1.5 us, 1.5 sy, 0.0 ni, 96.9 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st
MiB Mem : 15711.3 total, 249.5 free, 5492.6 used, 9969.2 buff/cache
MiB Swap: 7.8 total, 0.0 free, 7.8 used. 10737.8 avail Mem

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
6988 20 0 1367208 735248 71652 S 6.2 4.6 1913:13 useridd
7089 nobody 20 0 53484 10880 3132 S 6.2 0.1 392:57.99 redis-ser+
17268 nobody 20 0 732240 54880 13300 S 6.2 0.3 117:01.15 httpd

lines 151-173 6974 20 0 2329128 714468 138500 S 0.0 4.4 269:29.62 devsrvr

[T.XuanDung]

@reaper 

daemon devsrvr is running and cpu, memory is normal but I ran the command to check URL Filtering:
test url city.sakura.lg.jp
It returned: Server error: Failed to get response from device server. Please try again later.

> show system software status

Slot 0, Role mp
----------------------------------------
Process devsrvr running (pid: 6974)

> show system resources

top - 13:37:08 up 101 days, 24 min, 1 user, load average: 0.25, 0.22, 0.15
Tasks: 246 total, 1 running, 245 sleeping, 0 stopped, 0 zombie
%Cpu(s): 1.5 us, 1.5 sy, 0.0 ni, 96.9 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st
MiB Mem : 15711.3 total, 249.5 free, 5492.6 used, 9969.2 buff/cache
MiB Swap: 7.8 total, 0.0 free, 7.8 used. 10737.8 avail Mem

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
6988 20 0 1367208 735248 71652 S 6.2 4.6 1913:13 useridd
7089 nobody 20 0 53484 10880 3132 S 6.2 0.1 392:57.99 redis-ser+
17268 nobody 20 0 732240 54880 13300 S 6.2 0.3 117:01.15 httpd

lines 151-173 6974 20 0 2329128 714468 138500 S 0.0 4.4 269:29.62 devsrvr