Data plane cpu 100% (pa-3410)

[A.Bekim]

Hello!

We have a PA-3410 in our corporate network, and yesterday we encountered a problem: the data plane CPU reached 100%, and disabling the Decryption rules helped. Are there any solutions to this issue?

Device is up : 53 days 12 hours 43 mins 57 sec

Packet rate : 232,316/s Throughput : 1,559,508 Kbps

Total active sessions : 86,673

Active TCP sessions : 50,486

Active UDP sessions : 34,916 Active ICMP sessions : 1,071

[mshekh]

Hi @A.Bekim ,

Greetings!

Please refer the below kb article to troubleshoot high DP CPU related issue.

https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000ClRT

[fabioaquino]

Hello A.Bekim!

One thing that often increases CPU consumption is reports. I suggest checking if there are any reports constantly running. Use the following command to check: 'show clockreport jobs'.

However, the 'show system resources follow' command will give you a good overview of what might be demanding on the firewall's resources.

[A.Bekim]

There is no such show clockreport jobs command on the PA-3410,

show system resources follow: 

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
8860 root 20 0 137.7g 2.6g 2.6g R 100.0 8.6 78327:52 pan_task
8863 root 20 0 137.7g 2.6g 2.5g R 100.0 8.3 78330:05 pan_task
8865 root 20 0 137.7g 2.6g 2.5g R 100.0 8.3 78312:16 pan_task
8873 root 20 0 137.7g 2.6g 2.5g R 100.0 8.4 78341:56 pan_task
13931 root 20 0 137.6g 2.6g 2.5g R 100.0 8.3 1539:04 pan_task
14124 root 20 0 137.7g 2.6g 2.5g R 100.0 8.3 1538:15 pan_task
8861 root 20 0 137.8g 2.6g 2.5g R 99.7 8.3 78292:43 pan_task
8862 root 20 0 137.7g 2.6g 2.5g R 99.7 8.3 78343:11 pan_task
8871 root 20 0 137.7g 2.6g 2.5g R 99.7 8.3 78317:14 pan_task
6403 root 20 0 2201652 126584 10408 S 13.0 0.4 6237:38 identityclient
12171 root 20 0 3237068 1.1g 95184 S 8.0 3.6 81:46.33 logrcvr
4149 root 10 -10 130.0g 61124 4176 S 2.7 0.2 2092:03 brdagent
6463 root 17 -3 1326992 92700 20676 S 1.3 0.3 908:17.27 routed
3846 root 15 -5 227204 38580 9236 S 1.0 0.1 685:15.28 sysd
7360 root 20 0 0 0 0 R 1.0 0.0 827:25.86 vhost-4150
12131 root 20 0 890252 226168 69336 S 1.0 0.7 18:20.18 useridd
6448 root 20 0 708520 45084 9204 S 0.7 0.1 483:39.51 pan_dhcpd
6454 root 20 0 844324 158240 14336 S 0.7 0.5 635:22.58 dnsproxyd
8859 root 20 0 2415500 119984 86624 S 0.7 0.4 727:08.31 wifclient
11999 root 20 0 571272 63620 16056 S 0.7 0.2 5:56.44 distributord
27814 root 20 0 1612224 46864 16120 S 0.7 0.1 0:45.65 sslmgr
11 root 20 0 0 0 0 I 0.3 0.0 73:31.13 rcu_sched
3828 root 0 -20 9886.2m 2.6g 2.5g S 0.3 8.5 260:29.94 md_apps
4075 root 20 0 688676 74452 16980 S 0.3 0.2 9:11.65 dagger
4115 nobody 20 0 59496 10428 2500 S 0.3 0.0 69:07.47 redis-server
5361 a.bekim 20 0 79720 5004 4072 S 0.3 0.0 0:00.10 sshd
5535 nobody 20 0 869032 57224 16008 S 0.3 0.2 0:55.88 httpd
6091 nobody 20 0 868936 60772 20400 S 0.3 0.2 0:20.70 httpd
6242 root 20 0 1968260 614180 131340 S 0.3 1.9 367:07.68 devsrvr
6347 nobody 20 0 59496 10252 2640 S 0.3 0.0 97:59.32 redis-server
6358 nobody 20 0 62056 10204 2868 S 0.3 0.0 298:05.51 redis-server
7402 root 20 0 1018636 96860 4696 S 0.3 0.3 196:38.73 mongod
8851 root 20 0 137.6g 2.6g 2.5g S 0.3 8.3 135:24.97 pan_dha
8856 root 20 0 137.6g 2.6g 2.5g S 0.3 8.3 61:35.92 mprelay
8858 root 20 0 137.6g 2.5g 2.5g S 0.3 8.3 95:20.74 tund
11171 root 20 0 2315112 32448 4924 S 0.3 0.1 177:15.83 envoy
14093 root 20 0 655676 89896 16380 S 0.3 0.3 1:59.14 iotd
21876 nobody 20 0 868908 60576 20296 S 0.3 0.2 0:07.71 httpd
31354 root 20 0 7420 2536 1772 S 0.3 0.0 0:00.12 crond
32724 nobody 20 0 868892 60592 20336 S 0.3 0.2 0:02.46 httpd

[fabioaquino]

1.
Bekin,


What is the box model?
How many cores does it have?
So it must be at least 8, as there are several pan_task proceses and this must be one for each core, unless i'm mistaken.