Firewall deployed on Azure is showing MP constantly high

[M.Sharma415844]

Hi Team,
Please be informed that we have Palo Alto firewall deployed on Azure platform with below details.

family: vm
model: PA-VM
vm-license: VM-SERIES-4
vm-cap-tier: T2-14GB
vm-cpu-count: 4
vm-memory: 14351728
vm-mode: Microsoft Azure
cloud-mode: cloud
sw-version: 10.2.9-h1

Based on above details, I checked and found out this document which explains maximum default data plane vCPUs are 4 for 14 GB memory.
https://docs.paloaltonetworks.com/vm-series/10-2/vm-series-deployment/license-the-vm-series-firewall...

If I run the command "show running resource-monitor second last 60" so I can see that this firewall have 4 cores. 3 out of 4 cores are for DP and only one core is for MP.

Now if I check the dashboard, I can see that firewall MP is constantly high. I ran the command "show system resources follow" and observed that 'userid' process is constantly utilizing 70to 80 % CPU.

I further checked the userid logs and I have observed that firewall is trying to make a connection with Terminal Server Agents configured in the User Identification which is getting failed. There are 7 TSA are configured.

Please advise below:

1. As per my understanding, as firewall is trying to make a connection with TSA agents constantly, this is the reason process 'userid' is showing high and this is the reason MP CPU is also showing high.
2. Also, I am looking for confirmation regarding no of CPUs and cores for this firewall.

[LMaxinoiu]

Hi M.Sharma415844,

Your firewall is on version 10.2.9-h1.

There are several fixes in the later versions indicating problems with either memory corruption or similar issues in regards to the useridd process:

https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/pan-os/10-1/pan-os-release-notes/pa...

I would upgrade the firewall to the preferred release which at the time of writing this reply is:

P 10.1.13-h1 05/02/24 Preferred Release

All the best,