EAL-Logging and Wifclient OOM

EAL-Logging and Wifclient OOM

406
Created On 06/14/26 23:15 PM - Last Modified 08/09/26 06:34 AM


Symptom


  • PA-3430  runnng 11.1.13-h1 suffers multiple OOMs
  • Enhanced-application-logging is enabled
  • The global counter ctd_wif_send_raw shows a high value, rapidly incrementing (delta/rate) value. 

Environment


  • PA-3430 running 11.1.13-h1 

Cause


  • Huge traffic spike AND high memory usage when EAL is enabled
  • PAN-OS firewalls running 11.2.0, 12.1.0, 12.2.0 
  • show counter global | match "ctd_wif_send_raw" will show a large value consistenly

Resolution


  • Run : debug iot eal key-value EAL_PENDING_BYTES=1000. 
    This however, will only addresses run time situation. 
  • For a persistent solution, we will need to upgrade to the fixed versions of PAN-285181 or need to edit the SDB variable as below:

    First check the existing value with
    #sdb cfg.general.max-eal-pending-bytes*
    Then set the value as below
    # sdb cfg.general.max-eal-pending-bytes=1000 
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000wlNmKAI&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail