Selective push to FW fails with error "mongo_find failed Sort operation used more than the maximum 33554432 bytes of RAM"
Symptom
During a selective push from Panorama, the push may fail with the error: “Unable to create selective push config.”
On reviewing the configd logs, the following error can be seen:
2025-11-06 20:44:05.598 +0000 Error: pan_mongo_output_error(pan_mongo.c:515): [MongoDB Failure] mongo_find failed: 0(96), Executor error during OP_QUERY find :: caused by :: errmsg: "Sort operation used more than the maximum 33554432 bytes of RAM. AdEnvironment
**Product_versions**
• PAN-OS: 11.0.1-hx
• PAN-OS: 11.1.11
Hardware Details
• M-600 Panorama
• M-700 Panorama, Panorama VM
Cause
The root cause is an internal error during selective push config generation, specifically due to the sort operation exceeding the maximum allocated RAM (33554432 bytes) within MongoDB. This memory exhaustion happens when processing a large number of configuration changes or policies, especially those involving Dynamic Address Groups (DAGs), preventing the Panorama from successfully generating the selective push configuration.
Resolution
Workarounds:
1. Do a Full Push
Instead of selective push, go with a full push from Panorama. This avoids the MongoDB sort limit issue seen during selective push.
2. Don’t Let Changes Pile Up
This issue is commonly seen when the number of changes to be pushed is high. In most cases, the firewall is still in sync with an older Panorama config (older base config), so it ends up needing to process a large number of changes in one go.
To avoid this:
- Don’t accumulate too many changes.
- Push changes frequently.
- Keep the firewall in sync with the latest Panorama config.
If the base config is already up to date, the number of changes per push stays low, and this issue is less likely to occur.