High management CPU due to corrupted log index files

High management CPU due to corrupted log index files

6148
Created On 01/10/23 00:46 AM - Last Modified 04/22/24 07:08 AM


Symptom


  • High MP CPU
  • Internal script is run every 15 minutes to generate bdx and idx index for different log types.
  • Due to this script constantly running at high rate, it causes MP CPU to be high.
  • The masterd_detail logs (less mp-log masterd_detail.log)  and indexgen.log ( less mp-log indexgen.log) display the failed messages
+0700 Error: _bdx_merge_dictionary_and_rowset(pan_logdb_indexer_v2.c:5303): num_rowids_copied and num_to_copy exceed the ttl records from merged file
+0700 Error: _bdx_merge_dictionary_and_rowset(pan_logdb_indexer_v2.c:5303): bdx file sanity check fail, removing the idx file /opt/pancfg/mgmt/logdb/traffic/1/20211020/pan.0005162212.log.receive_time.idx
+0700 Error: _bdx_merge(pan_logdb_indexer_v2.c:5405): Error merging the blocks in a block index
+0700 Error: pan_logdb_bdx_merge(pan_logdb_indexer_v2.c:5509): Error merging blocks in a block index
Error: main(pan_logdb_indexer.c:680): pan_logdb_bdx_merge() failed


Environment


  • Palo Alto Firewalls
  • PAN-OS 10.0.8 or below and 10.1.6 and below.
  • High MP CPU


Cause


Software Issue.

Resolution


  • The issue is fixed under PAN-155730 in PANOS 10.0.9, 10.1.6.
  • Upgrade to the newer codes will fix the issue.


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kG9HCAU&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language