Network Management

High CPU load on Palo Alto firewalls when polling bps on Global Protects

If you have NPM 12.5 RC or RTM installed and are experiencing high CPU load on a monitored Palo Alto firewall, disable Global Protect bps polling. If the node is polled by an additional polling engine, you might need to restart the Cortex service on the polling engine.

First published date

5/23/2019 6:25 PM

Last published date

5/30/2019 11:09 AM

Overview

When you have upgraded to NPM 12.5 RC1 and are experiencing high CPU load on a monitored Palo Alto node, upgrade to NPM 12.5 RTM. In the RTM version, bps polling is disabled by default and the polling frequency uses the Default Statistics Polling Frequency (10 minutes by default) which prevents CPU load issues. 

Product section

Network Performance Monitor

Cause

Polling bps on Global Protects may result in high load on the Palo Alto Management CPU. NPM 12.5 RTM disables bps polling, but in specific cases, you might need to restart the Cortex service.

Resolution

  1. Upgrade to NPM 12.5 RTM. BPS polling is disabled.
  2. If the issue persists, check the polling engine used to poll the Palo Alto node. On Node Details view, click Edit Node in the Management widget.
  3. Scroll down to the Polling Engine setting  and check the node used to poll the Palo Alto node.
  4. If the node is polled by an additional polling engine, restart the Cortex service on the polling engine. See Shutdown and restart Orion services.