Palo Alto Dataplane High CPU: show running resource-monitor Before You Reboot

Palo Alto · Techclick CLI troubleshooting lab

Latency jumps every 10 minutes. GUI says dataplane 95%. Someone already scheduled a reboot.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Palo Alto for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Use show running resource-monitor and packet-diag before reboot. High CPU is usually one flow, one app-id, or one flood — reboot only hides the next cycle.

Why this ticket shows up

PAN-OS dataplane CPU climbs when a single session is scanned hard, when a zone-protection flood is active, or when a debug is left on.

Symptoms operators actually see

• Management plane fine, dataplane red

• Periodic slowness, not a hard down

• One source IP dominates session table

• debugs left on from last night

CLI first — copy this block

Run these on the Palo Alto device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show running resource-monitor
show running resource-monitor ingress-backlogs
show session info
show session all filter count yes
show counter global filter delta yes severity drop
debug dataplane packet-diag show setting

How to read that output

resource-monitor shows which stage (flow_lookup, appid, threat) is hot. ingress-backlogs names the interface. If packet-diag is still on, turn it off first — leftover debug can create the CPU you are chasing.

Triage order

1. Confirm packet-diag is off.

2. Read resource-monitor for the hot stage.

3. Find elephant flows with show session all filter min-kb 10000.

4. If one host floods, apply zone-protection or DoS policy, do not reboot.

5. Only reboot if the monitor is wedged after you clear debugs and floods.

Classic traps

What you see	Real cause	Fix
Reboot first	Debug still on	Clear packet-diag
CPU is management	It is dataplane	Do not restart management-server
More cores needed	One flow is scanned by every threat profile	Tune the profile or app

Proof the ticket is closed

• Dataplane CPU back under 50%

• No leftover packet-diag

• The elephant flow is identified

Say this in an interview

I treat dataplane CPU as a flow problem until resource-monitor proves otherwise. Reboot is last.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/