I see a log indicating that the number of hints exceeded 5,000 after the OS upgrade.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

I see a log indicating that the number of hints exceeded 5,000 after the OS upgrade.

L1 Bithead

Hello Team,

 

After upgrading the OS (11.1.6-h10 -> 11.1.13-h7), hint-related logs are appearing in the system logs.

I am aware of the cause. I am not using Panorama, and the log forwarding profile has "Panorama" checked as the forwarding method, with this profile applied to the policy.

 

However, despite having the same configuration, hint-related logs were not present in the system logs before the OS upgrade, but they started appearing after the upgrade.

 

Should I open a case with TAC to investigate this?

 

SangHoonLee_0-1782434882221.png

 

4 REPLIES 4

Cyber Elite

Hello @SangHoonLee

 

thanks for post!

 

Could you have a look at this KB: High CPU use by logrcvr process and system log message "Number of hints on disk has exceeded 5000 du...? From your description it looks like you have Panorama log forwarding enabled despite not using Panorama to store logs. If this is the case try to disable Panorama log forwarding. This is likely a root cause. Also, this issue is not limited to Panorama. Setting log forwarding to Strata Logging Service could cause this as well.

 

Kind Regards

Pavel 

Help the community: Like helpful comments and mark solutions.

Hello PavelK

 

Thank you for your response. I am already aware that turning off log transmission to Panorama resolves this issue. However, the customer is curious about the cause of this issue occurring after the OS upgrade. The configuration is the same before and after the OS operation, but Hint logs appear after the upgrade.

Thank you,

Best Regards.

Cyber Elite

Thank you for reply @SangHoonLee

 

I see. Unfortunately, I am not able to answer what triggered it after this version upgrade. Software bugs are unpredictable and unless there is something mentioned in release notes (known issues / addressed issues) we as a customers can't determine it. We are back to question you asked in your original post whether you should open a TAC case. I guess TAC is the only place to go in this case.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Hello PavelK,

 

I have uploaded the case to TAC. Thank you for your advice.

 

Thank you,

Best Regards.

  • 279 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!