Panorama failover due large core files saved in root partition
4553
Created On 07/22/22 21:06 PM - Last Modified 05/13/23 03:16 AM
Symptom
- Panorama server becomes non-functional due large-core generated in root partition reaching 100%,
- MP-Monitor logs (less mp-log mp-monitor.log) display the 100 percent usage.
swapusage http2022-05-02 20:32:02.776 -0700 --- filesystem
swapusage Disk usage for / exceeds limit, 100 percent in use, cleaning filesystem
swapusage Removing /var/cores/core.28818, size 3308515328
- In the example above, the file size was around 3.3 GB, Panorama failed went to non- functional, and failed over.
Environment
- Panorama.
- Any PAN OS.
Cause
The issue is caused due the large core file saved in the root partition.
Resolution
- Enable aggressive cleaning. This process automatically purges files in the root partition, when the root disk space reaches 95%. It can be enabled by using the command specified below:
> debug software disk-usage aggressive-cleaning enable
- The second option is to enable large-core files. Large core feature allows saving a core file under /opt/panlogs folder instead of /var/cores. Since the size of /opt/panlogs is much larger than /var/cores, large core files can be saved.
To enable a feature issue the following command from CLI:
> configure
# set deviceconfig setting management large-core yes
# commit
# exit
- The large core files can be deleted if they have been analyzed. Contact Support if the files need to be deleted.