High MP Memory consumption on PA-5200 Series firewall
57692
Created On 02/28/19 22:54 PM - Last Modified 01/15/24 21:53 PM
Symptom
When running the command show system resources from the CLI, high physical memory consumption is seen on the management plane
Example:
PA-5220> > show system resources 2019-02-28 00:49:48.058 +0100 --- top top - 00:49:48 up 13 days, 9:01, 0 users, load average: 0.50, 0.29, 0.25 Tasks: 219 total, 1 running, 216 sleeping, 0 stopped, 2 zombie Cpu(s): 0.2%us, 0.2%sy, 0.0%ni, 99.5%id, 0.1%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 32640996k total, 28688244k used, 3952752k free, 686940k buffers >>>>Note that 28688244k memory is used out of 32640996k Swap: 2007996k total, 0k used, 2007996k free, 24159980k cached
Looking into the process details, there are no processes consuming high memory.
Environment
- PA-5200 Series firewall
- PAN-OS Software version: 8.x and above.
Cause
Majority of the memory is cached by the Kernel.
Resolution
This is by design and expected.
Example:
=========
2019-02-28 00:49:48.058 +0100 --- top top - 00:49:48 up 13 days, 9:01, 0 users, load average: 0.50, 0.29, 0.25 Tasks: 219 total, 1 running, 216 sleeping, 0 stopped, 2 zombie Cpu(s): 0.2%us, 0.2%sy, 0.0%ni, 99.5%id, 0.1%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 32640996k total, 28688244k used, 3952752k free, 686940k buffers Swap: 2007996k total, 0k used, 2007996k free, 24159980k cached >>>>Notice the memory cached by Kernel
Similarly, at various time stamps, the same can be seen when running the show system resources command:
Mem: 32640996k total, 32368624k used, 272372k free, 286620k buffers Swap: 2007996k total, 89740k used, 1918256k free, 26477036k cached
Mem: 32640996k total, 32444204k used, 196792k free, 287720k buffers Swap: 2007996k total, 89740k used, 1918256k free, 26509804k cached
Mem: 32640996k total, 32419920k used, 221076k free, 288616k buffers Swap: 2007996k total, 89736k used, 1918260k free, 26449000k cached
Mem: 32640996k total, 32426096k used, 214900k free, 290308k buffers Swap: 2007996k total, 89736k used, 1918260k free, 26487548k cached
Additional Information
Swap memory of 3200 series firewall is 100% Utilized
Available Memory Estimate on PAN-OS version 9.0+
On newer versions (9.0+), the output of show system resources has a new format and includes “avail Mem” (also called MemAvailable) which represents the best estimate of available memory that can be used by processes without utilizing Swap memory.
2022-03-09 22:52:28.306 +0530 --- top_summary
top - 22:52:28 up 25 days, 20:34, 0 users, load average: 1.33, 1.33, 1.25
Tasks: 297 total, 1 running, 188 sleeping, 0 stopped, 1 zombie
%Cpu(s): 2.7 us, 1.1 sy, 0.1 ni, 95.7 id, 0.0 wa, 0.2 hi, 0.1 si, 0.0 st
KiB Mem : 32603288 total, 234928 free, 6631788 used, 25736572 buff/cache
KiB Swap: 0 total, 0 free, 0 used. 25323180 avail Mem
The value of buffers and cached are now in a single field called buff/cache. In some cases, not all memory in buff/cache may be reclaimable. So “avail Mem” should be used to estimate how much RAM system has remaining for new workload. This is applicable for all PAN-OS platforms.