High management CPU due to corrupted log index files
6148
Created On 01/10/23 00:46 AM - Last Modified 04/22/24 07:08 AM
Symptom
- High MP CPU
- Internal script is run every 15 minutes to generate bdx and idx index for different log types.
- Due to this script constantly running at high rate, it causes MP CPU to be high.
- The masterd_detail logs (less mp-log masterd_detail.log) and indexgen.log ( less mp-log indexgen.log) display the failed messages
+0700 Error: _bdx_merge_dictionary_and_rowset(pan_logdb_indexer_v2.c:5303): num_rowids_copied and num_to_copy exceed the ttl records from merged file
+0700 Error: _bdx_merge_dictionary_and_rowset(pan_logdb_indexer_v2.c:5303): bdx file sanity check fail, removing the idx file /opt/pancfg/mgmt/logdb/traffic/1/20211020/pan.0005162212.log.receive_time.idx
+0700 Error: _bdx_merge(pan_logdb_indexer_v2.c:5405): Error merging the blocks in a block index
+0700 Error: pan_logdb_bdx_merge(pan_logdb_indexer_v2.c:5509): Error merging blocks in a block index
Error: main(pan_logdb_indexer.c:680): pan_logdb_bdx_merge() failed
Environment
- Palo Alto Firewalls
- PAN-OS 10.0.8 or below and 10.1.6 and below.
- High MP CPU
Cause
Software Issue.
Resolution
- The issue is fixed under PAN-155730 in PANOS 10.0.9, 10.1.6.
- Upgrade to the newer codes will fix the issue.