configd crash on Panorama
13211
Created On 04/04/22 15:49 PM - Last Modified 12/29/22 04:26 AM
Symptom
- Panorama is responding slow and Configd crash during commit operation.
- Configd process utilizing high memory (show system resources | match config)
Environment
- Panorama with Managed Firewalls
- PAN-OS 9.1 and above
Cause
- Incorrect configuration, Firewalls are configured to connect to Panorama while Panorama side is not configured to acknowledge and connect.
- This can be observed in the configd logs (less mp-log configd.log) of Panorama which report the following errors.
Error: pan_cfg_handle_mgt_reg(pan_cfg_mgt_handler.c:4858): This device or log collector or wf appliance (devid <serial number>) is not managed
Error: pan_cfg_handle_mgt_reg(pan_cfg_mgt_handler.c:4858): This device or log collector or wf appliance (devid ..) is not managed
Error: pan_cfg_handle_mgt_reg(pan_cfg_mgt_handler.c:4858): This device or log collector or wf appliance (devid unknown) is not managed
Error: pan_cfg_handle_mgt_reg(pan_cfg_mgt_handler.c:4858): This device or log collector or wf appliance (devid <serial no>) is not managed
- The messages display devices constantly trying to connect with Panorama .
- The constant attempts, can lead to increase in memory utilization of configd over time followed by crash.
Resolution
- The firewalls sending the registrations can be identified in the configd logs. From the Error: pan_cfg_handle_mgt_reg (…), note down the serial numbers
- Fix the incorrect configurations by either adding these firewalls to Panorama or Remove the Panorama IP on Firewalls.
- This will fix the constant reconnect issue and helps in reducing the memory utilization of configd process.