AIOps Alert "Adverse Resource Usage"

• PAN-OS
• AIOps

The device is experiencing an increase in traffic that has resulted in one or more of the following symptoms: 

• A sudden burst in connections per second (CPS) rate.
• A sudden burst in the number of long-lived sessions.
• A SYN-flood attack even when the device is configured to use DOS protection.
• Approaching CPS, session table, or throughput capacity. 

To troubleshoot the problem:

1. Review the related metrics to identify the problem at hand.
2. Identify source of traffic
   1. Compare the ACC report during the high traffic usage as compared to the lower traffic usage. Identify the traffic that could be the cause of the increase in the metric. How to use ACC KB . If the traffic source is legitimate then the device is reaching its capacity limits and an upgrade to a larger platform might be necessary.
   2. This increase in traffic could also be caused by a DoS attack. Identify the source of traffic burst and prevent the possibility of DOS attack.