XML API: Meaning of cpu load-average / load-maximum values

[InetRIT]

Hello,

first of all I am new to Palo Alto Firewalls and I`m highly impressed about the xml api which comes with palo alto. very cool and useful stuff! It took me just a couple of hours to fulfill some management requirements on reporting. Now I want to go on and create a monitoring script, which checks the cpu-cores for "long-time high-utilization per core". I found the following path on the api:

API-> Operational Commands -> show -> running -> resource-monitor

But I`m quite unsure, what the real meaning of the delivered values is? I get cpu-load-average and maximum-load-average, both with a list of values. But I cant figure out what the exact meaning is. Even I miss some utilization metrics. Are these utilization metrics exposed by the api? Can one shed some light on this or point me to the documentation on that?

Thanks in advance,

Tom

[HULK]

Hello IneRIT,

The resource monitor will give you a brief history of the PAN firewall's Data-palane utilization. Shows the last minute, 60 minutes, 24 Hrs and 7 days averages of load on the Data-plane CPU.

day ------------------ Per-day monitoring statistics

hour------------------- Per-hour monitoring statistics

minute ----------------Per-minute monitoring statistics

second---------------- Per-second monitoring statistics

week------------------- Per-week monitoring statistics

But the load average concept will come for management-plane CPU utilization ( MP-CPU): load averages with three numbers that indicate how much load is on system and CPU. The load averages show the last minute, five minutes and fifteen minute averages of load on the MP ( I think so  ).

FYI:

> show system resources

top - 10:54:19 up 7 days, 23:07,  2 users,  load average: 0.04, 0.02, 0.00 >>>>>>>>>>>>>>

As per my understanding, from a general microprocessor concept:

CPU time:  If one process is running with complete demand on a processor, it is said to contribute 1.00 to the load average. Two processes demanding full time, when run evenly on two processors (or cores), would contribute 2.00 to the load average.

I/O time:  Any process currently requesting read or write to a block device (such as a hard disk) increases the load by 1.00 while the I/O is being requested. If a process is waiting on a read(), and the kernel has not returned, (Eg. hang while in read) the load average could show high while the CPU is relatively idle. This will still reflect a high load average based on the I/O demand even though the rest of the system can be reasonably responsive.

Thanks

[InetRIT]

Hello Hulk,

thanks a lot for your detailed explanation on cpu / io time and their impact on the overall system load. I think I mispelled my question. In my case,

I was looking for a monitoring object which holds the "per core cpu utilization", to cover the case, if i.e. the pdf-scanning-engine does an "endless unpack of pdf docs" and keeps a single cpu core busy for a very long time. As I mentioned before I found the

API-> Operational Commands -> show -> running -> resource-monitor and this object returns a list of numbers where I was in doubt about their meaning. Load or percent utilization of the individual cpu-core?

The output of the api query looks like the following:

...

<cpu-load-average>

<entry><coreid>1</coreid>

<value>4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,5,4,4,4,4,4,4,4,4,4,4,4,4,4,4,5,4,4,4,4,4,4,4,3,4,4,4</value>

</entry>

<entry><coreid>2</coreid>

<value>11,9,9,9,9,10,10,9,9,10,9,10,10,10,10,10,10,10,10,11,9,10,10,10,11,10,9,9,9,10,9,10,10,12,12,10,10,9,10,11,10,10,10,10,11,9,9,9,10,10,11,10,10,10,9,9,9,9,9,9</value>

</entry>

<entry><coreid>3</coreid>

<value>21,17,18,17,18,18,19,18,19,19,17,21,20,19,18,22,22,20,19,22,19,19,22,19,20,19,17,18,19,20,18,19,21,23,21,19,23,20,23,24,21,20,20,19,20,18,16,17,18,18,21,17,17,18,17,18,20,17,18,18</value>

</entry>

...

From the XML Structure where the values are embedded in, they should be load-averages. But an load-average on a single core with a value of 20 (as coreid 3)? Does it make any sense? So the question is: are these values load-averages or percent utilization values?

Thanks a lot,

Best Regards,

Tom