How to verify if device reboot was caused by external power loss using smart disk stats
12859
Created On 05/17/24 23:50 PM - Last Modified 05/17/24 23:54 PM
Objective
- After an unexpected firewall or Panorama reboot, you may want to verify whether an external power loss caused the reboot
- PAN-OS records SMART disk statistics into mp-monitor.log
- SMART disk statistics records power_cycle_count which is a counter that increments by 1 any time external power is lost
- By comparing the power_cycle_count before and after reboot, we can identify whether external power loss caused the reboot
Environment
- Firewall or Panorama running PAN-OS
Procedure
- From the device CLI run this command which searches the mp-monitor logs for smart disk power_cycle_count
> grep mp-log mp-monitor.log* pattern "smart\|^Disk \|ATTRIBUTE_NAME\|Power_Cycle_Count"
- The output will print the timestamp, disk name, and power_cycle_count value for each poll of smart disk stats:
2024-05-14 01:20:22.381 +0000 --- smart Disk Sys1: /dev/sda ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE 12 Power_Cycle_Count 0x0032 100 100 000 Old_age Always - 95 2024-05-14 01:30:21.535 +0000 --- smart Disk Sys1: /dev/sda ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE 12 Power_Cycle_Count 0x0032 100 100 000 Old_age Always - 96
- Find the timestamp when the reboot occurred and compare the raw_value (last column) for the output before and after the reboot
- In the example above, the value changed from 95 to 96, which confirms that an external power loss occurred between timestamp 01:20 and 01:30
Additional Information
- Some platforms have multiple disks so when you parse the command output, ensure that you are comparing values for the same disk. In the example above we are specifically looking at Disk Sys1
- If the value for power_cycle_count remains the same before and after reboot, the cause of the reboot is not external power loss. One possible cause may be an admin requesting a system restart.