>
    Strata Copilot
    Incidents in Strata Cloud Manager Reference
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Manage NGFW Incidents
    4. Incidents in Strata Cloud Manager Reference
    Download PDF
    Next-Generation Firewall

    Incidents in Strata Cloud Manager Reference

    Table of Contents

    Incidents in Strata Cloud Manager Reference

    This topic provides details of the NGFW incidents in Strata Cloud Manager.

    Incident: Approaching High Session Table Utilization

    Incident Code
    INC_NGFW_RESOURCES_SESSION_TABLE_USAGE
    Category
    Device
    Subcategory
    System Resources
    Description
    Approaching High Session Table Utilization
    Raise Condition
    When Session Table Utilization exceeds 85% of usage for 20 minutes
    Clear Condition
    When Session Table Utilization is less than 85% of usage for 2 hours

    Incident: Approaching Max Capacity - Configuration Size

    Incident Code
    INC_NGFW_RESOURCES_CONFIG_SIZE_USAGE
    Category
    Device
    Subcategory
    System Resources
    Description
    This incident triggers when the configuration file size approaches the maximum supported capacity, indicating that the device is nearing its configuration storage limit.
    Raise Condition
    When the firewall configuration size reaches 90% of the device recommended configuration size limit and sustains for 3 days staying at 90% or more
    Clear Condition
    When the firewall configuration size is less than 90% of the device recommended configuration size limit for that respective model and stays less than 90% for 3 days

    Incident: Approaching Max Capacity - Connections Per Second(CPS)

    Incident Code
    INC_NGFW_CAPACITY_CONNECTIONS_PER_SECOND
    Category
    Device
    Subcategory
    System Resources
    Description
    The firewall has anomalous values for connections per second (CPS).
    Raise Condition
    When Connections Per Second(CPS) usage exceed 90% of the capacity of that respective firewall model and stays beyond 90% for five days in a week
    Clear Condition
    When Connections Per Second(CPS) usage falls below 90% of the capacity of that respective firewall model and stays below 90% for 1 week

    Incident: Approaching Max Capacity - Session Table Utilization

    Incident Code
    INC_NGFW_CAPACITY_SESSION_TABLE_UTILIZATION
    Category
    Device
    Subcategory
    System Resources
    Description
    Approaching MAX Capacity: High Session Table Utilization
    Raise Condition
    When Session Table Utilization exceed 90% of the capacity of that respective firewall model and stays beyond 90% for five days over a week
    Clear Condition
    When Session Table Utilization falls below 90% of the capacity of that respective firewall model and stays below 90% for two weeks

    Incident: Approaching Max Capacity - System Throughput

    Incident Code
    INC_NGFW_CAPACITY_SYSTEM_THROUGHPUT
    Category
    Device
    Subcategory
    System Resources
    Description
    The firewall has anomalous values for throughput.
    Raise Condition
    When System Throughput usage exceed 90% of Threat Prevention throughput capacity of that respective firewall model and stays beyond 90% for five days in a week
    Clear Condition
    When System Throughput usage falls below 90% of Threat Prevention throughput capacity of that respective firewall model and stays below 90% for 1 week

    Incident: Card Power Failure

    Incident Code
    INC_NGFW_CARD_POWER_FAIL
    Category
    Device
    Subcategory
    Hardware
    Description
    A card failure has been detected, suggesting a potential issue with the card or its seating within the chassis.
    Raise Condition
    Card power failure has been detected.
    Clear Condition
    Card power failure is no longer detected.

    Incident: Certificate Expiration

    Incident Code
    INC_NGFW_CERTIFICATE_EXPIRY_EXCEEDED_THRESHOLD
    Category
    Device
    Subcategory
    Management
    Description
    One or more certificate(s) on the firewall have been revoked or are expiring soon.
    Raise Condition
    This incident is raised when the certificate in question has to be renewed in less than 60 days
    Clear Condition
    The incident is cleared when the certificate's renewal data is above 60 days (such as when the certificate is renewed)

    Incident: Config Memory Usage Approaching Max Limits

    Incident Code
    INC_NGFW_CONFIG_MEMORY_USAGE
    Category
    Device
    Subcategory
    System Resources
    Description
    The firewall's configuration is approaching its maximum memory usage limit. During commits, the firewall's total config memory must accommodate two copies: the current 'in-use' configuration and the new 'to-be-used' configuration. If the allocated memory per configuration exceeds 50%, the firewall reaches capacity, resulting in commit failure.
    Raise Condition
    When configuration memory usage exceed 90% of the capacity of that respective firewall model and stays beyond 90% for five days over a week.
    Clear Condition
    When configuration memory usage falls below 90% of the capacity of that respective firewall model and stays below 90% for two weeks.

    Incident: Device in HA Pair Transitioned to Unhealthy State

    Incident Code
    INC_NGFW_HA_STATE_TRANSITIONED_UNHEALTHY
    Category
    Device
    Subcategory
    High Availability
    Description
    This incident triggers when a firewall or Panorama in a high availability (HA) pair transitions to an unhealthy state, such as Initial, Suspended, Non-Functional, or Tentative. These states indicate that the device may be unable to perform normal operations, maintain HA synchronization, or communicate effectively with peers or management systems.
    Raise Condition
    An alert is triggered when a member of the HA pair transitions into a non-operational state ( Suspended, Non-Functional).
    Clear Condition
    The alert is cleared when the HA member transitions to a healthy state (Passive, Active, Active-Primary, or Active-Secondary).
    Probable Root Cause Incident
    "INC_NGFW_HA_NON_FUNCTIONAL_DU_TO_LINK_DOWN",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_BRDAGENT_EXITING",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_DEVICE_ID_OVERLAP",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_DP_DOWN",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_DP_DOWN_BRDAGENT_EXISTING",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_DRIVE_ERROR",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_HA1_AP_MISMATCH",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_MULTI_VSYS_MISMATCH",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_PEER_VERSION_OLD",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_POLICY_PUSH_FAIL_TO_DP",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_PREEMPTION_LOOP",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_STATE_SYNC_MISMATCH",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_VENDOR_URL_MISMATCH",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_WAITING_POLICY_PUSH_TO_DP",
    "INC_NGFW_HA_NON_FUNCTIONAL_STATE_DUE_TO_PATH_DOWN"

    Incident: Firewall HA Failover

    Incident Code
    INC_NGFW_HA_FAILOVER
    Category
    Device
    Subcategory
    High Availability
    Description
    This incident triggers when a device in an HA pair undergoes a failover, causing the secondary device to assume the active role. This may indicate a disruption in the primary device or a configuration or environmental issue that triggered the HA state transition.
    Raise Condition
    When a device (NGFW or Panorama) unexpectedly fails over.
    Clear Condition
    Monitor for 3 days to clear the incident if there is no other High availability failover event in this duration. If in this 3 days if another HA failover event occurs then the 3 day timer begins again.

    Incident: Firewall losing logs

    Incident Code
    INC_NGFW_LOG_LOSS
    Category
    Network Services
    Subcategory
    Logging
    Description
    This alert indicates that DP logs (such as traffic, threat, URL, Netflow, User-ID, GP, Decryption, EAL, etc.) that are supposed to be generated based on inspected traffic and logging configurations are being lost. When logs are generated in the DP, they are moved into logging queues, which are then handed over to the logrcvr in the Management Plane (DP to MP). To prevent the DP-to-MP channel from being overwhelmed, a rate-limiting mechanism was implemented to control the transfer of logs from the Data Plane to the Management Plane. This mechanism regulates either the logging count rate (logs/sec) or bandwidth usage (KB/sec). The control is in place to ensure that other services such as packet capture and any requests from DP to the cloud (e.g., URL, Wildfire, etc.), are not dropped due to excessive logging bandwidth consumption.
    Raise Condition
    Firewall is losing logs at dataplane and logs losing rate is greater than 50 logs per second at least for an hour. OR Dataplane(DP) to Management plane(MP) logs overflow and logs are lost due to rate-limiting between DP and MP.
    Clear Condition
    When the logs are being generated, retained and are not lost for 24 hr duration.
    Probable Root Cause Incident
    "INC_NGFW_FAILED_TO_SCHEDULE_A_LOG_FWD_CONTROL_JOB_FOR_DEVICE",
    "INC_NGFW_FSM_INIT_FAILED",
    "INC_NGFW_HIGH_LOG_RATE",
    "INC_NGFW_INTER_LOG_COLLECTOR_DISCONNECT",
    "INC_NGFW_LICENSE_NOT_PROVISIONED_LCAAS",
    "INC_NGFW_LOG_CERT_MISMATCH",
    "INC_NGFW_PAN_LC_DISCONNECTED_FROM_GROUP",
    "INC_NGFW_SYSLOG_CONN_LOST",
    "INC_NGFW_TCP_CONN_SYSLOG",
    "INC_NGFW_DROPPING_LOGS_FWD_QUEUE_FAIL"

    Incident: HA Backup

    Incident Code
    INC_NGFW_BACK_UP_LINK_NOT_CONFIGURED
    Category
    Device
    Subcategory
    High Availability
    Description
    The HA Backup link(s) are not currently configured.
    Raise Condition
    When either the HA1-backup or HA2-backup links are not configured
    Clear Condition
    When HA1-backup and HA2-backup links are configured

    Incident: HA Link Issue Detected

    Incident Code
    INC_NGFW_HA_LINK_ISSUE
    Category
    Device
    Subcategory
    High Availability
    Description
    This incident triggers when a change is detected in the status of one or more HA(High Availability) links between firewall peers. These links are critical for synchronizing session information, configuration, and state data. A status change may indicate that one or more HA links are down or unstable.
    Raise Condition
    When HA link status goes down. HA links are links that are configured for HA functionality ( HA1, HA1-backup HA2, HA2-backup, HA3)
    Clear Condition
    When the HA link has come back up and stays in up state atleast for 2 hours
    Probable Root Cause Incident
    "INC_NGFW_HA_OR_HA1_BACKUP_LINK_CONNECTION_FAILURE",
    "INC_NGFW_HA_OR_HA2_BACKUP_KEEP_ALIVES_DOWN"

    Incident: HA Peer Connection Status

    Incident Code
    INC_NGFW_HA_PEER_STATUS
    Category
    Device
    Subcategory
    High Availability
    Description
    One of the firewalls in the HA pair is in a non-healthy state.
    Raise Condition
    If the connection status for peer is down
    Clear Condition
    If connection status for peer is healthy

    Incident: High Dataplane CPU Activity Detected

    Incident Code
    INC_NGFW_DP_CPU_USAGE_EXCEEDED_THRESHOLD
    Category
    Device
    Subcategory
    System Resources
    Description
    High Dataplane CPU Activity Detected
    Raise Condition
    MAX DP CPU exceeds 95% for 15 minutes OR AVG DP CPU exceeds 85% for 1 hour
    Clear Condition
    Clears when MAX DP CPU stays below 95% and AVG DP CPU stays below 85% continuously for at least 2 hours.

    Incident: High Disk Space Usage - Pancfg Partition

    Incident Code
    INC_NGFW_DISK_RESOURCES_USAGE_PANCFG_PARTITION
    Category
    Device
    Subcategory
    System Resources
    Description
    This incident triggers when the disk space usage in the pancfg partition exceeds the defined threshold, indicating that the partition is running low on available storage capacity.
    Raise Condition
    If pancfg partition usage reaches 90% and stays there for at least 2 hours
    Clear Condition
    If pancfg partition usage is less than 90% and stays there for at least 12 hours

    Incident: High Disk Space Usage - Panlogs Partition

    Incident Code
    INC_NGFW_DISK_RESOURCES_USAGE_PANLOGS_PARTITION
    Category
    Device
    Subcategory
    System Resources
    Description
    This incident triggers when the disk space usage in the panlogs partition exceeds the defined threshold, indicating that the partition is running low on available storage capacity.
    Raise Condition
    If it reaches 97% usage and stays there for at least 6 hours.
    Clear Condition
    Less than 97% usage and stays there for at least 12 hours

    Incident: High Disk Space Usage on Root Partition

    Incident Code
    INC_NGFW_DISK_RESOURCES_ROOT_PARTITION_USAGE
    Category
    Device
    Subcategory
    System Resources
    Description
    This incident triggers when the disk space usage in the root partition exceeds the defined threshold, indicating that the partition is running low on available storage capacity.
    Raise Condition
    If the root partition in the disk exceeds 95% usage and stays there for at least 2 hours
    Clear Condition
    If the root partition is less than 95% usage and stays there for at least 12 hours

    Incident: High Management Plane CPU Activity Detected

    Incident Code
    INC_NGFW_MP_CPU_USAGE_EXCEEDED_THRESHOLD
    Category
    Device
    Subcategory
    System Resources
    Description
    High Management Plane CPU Activity Detected
    Raise Condition
    If the MP CPU usage goes beyond 95% and stays there for at least 15 minutes
    Clear Condition
    If the MP CPU usage is below 95% for at least 2 hours

    Incident: High Management Plane Memory Usage

    Incident Code
    INC_NGFW_MP_MEMORY_USAGE_EXCEEDED_THRESHOLD
    Category
    Device
    Subcategory
    System Resources
    Description
    High Management Plane memory usage has been detected.
    Raise Condition
    If the MP Memory usage goes beyond 95% and stays there for at least 20 minutes
    Clear Condition
    If the MP Memory usage is below 95% and stays there for at least 2 hours

    Incident: High Traffic Volume Detected - Connections Per Second

    Incident Code
    INC_NGFW_SYSTEM_CONNECTIONS_PER_SECOND
    Category
    Device
    Subcategory
    System Resources
    Description
    The firewall has anomalous values for connections per second (CPS).
    Raise Condition
    Based on Firewall model type if the Connections per second(CPS) is above 95% of what is possible on that model for 15mins
    Clear Condition
    Based on Firewall model type if the Connections per second(CPS) is less than 95% of what is possible on that model for 2 hours

    Incident: High Traffic Volume Detected - System Throughput

    Incident Code
    INC_NGFW_SYSTEM_THROUGHPUT
    Category
    Device
    Subcategory
    System Resources
    Description
    The firewall has anomalous values for throughput.
    Raise Condition
    Based on Firewall model type if the firewall Throughput is above 95% of Threat prevention thorughput of what is possible on that model for 15mins
    Clear Condition
    Based on Firewall model type if the Throughput is less than 95% of Threat prevention thorughput of what is possible on that model for 2 hours

    Incident: Increased Traffic Latency - Packet Descriptor

    Incident Code
    INC_NGFW_PACKET_DESCRIPTORS_USAGE_EXCEEDED_THRESHOLD
    Category
    Device
    Subcategory
    System Resources
    Description
    Packet Descriptor resources are running low on the device.
    Raise Condition
    If the Packet Descriptors usage exceeds 90% usage and stays there for 10 minutes
    Clear Condition
    If the Packet Descriptors usage is less than 90% usage for at least 4 hours

    Incident: Irregular Input Power

    Incident Code
    INC_NGFW_POWER_RAIL_FAILURE
    Category
    Device
    Subcategory
    Hardware
    Description
    Device power levels are outside of the normal range.
    Raise Condition
    In the output of "show system environmentals" CLI, the alarm flag is True for 4 hours
    Clear Condition
    If the alarm flag is false for 24 hours

    Incident: License Expiration

    Incident Code
    INC_NGFW_LICENSE_EXPIRY_EXCEEDED_THRESHOLD
    Category
    Device
    Subcategory
    Management
    Description
    One or more of your licenses are nearing or have reached expiration.
    Raise Condition
    This incident is raised when a software or feature license is nearing its expiration date. By default, this incident is generated if the license is due to expire within 90 days.
    Clear Condition
    This incident will be automatically cleared once the license has been successfully renewed or updated. The condition is met when the system verifies that the new license expiration date is more than 90 days in the future.

    Incident: MP Process Memory Depletion

    Incident Code
    INC_NGFW_MP_PROCESS_MEMORY_DEPLETION
    Category
    Device
    Subcategory
    System Resources
    Description
    This incident triggers when a Management Plane (MP) process on the firewall consumes excessive memory without releasing it, which may indicate a memory leak or abnormal behavior.
    Raise Condition
    Triggers when leak conditions are detected in more than 75% of the last 4 hours.
    Clear Condition
    Clears when the average MP system memory usage of the last 10 hours is below 60%, or when non-leak conditions occur in more than 75% of the last 4 hours.

    Incident: NAT Allocation Failure

    Incident Code
    INC_NGFW_NAT_ALLOCATION_FAILED
    Category
    Device
    Subcategory
    System Resources
    Description
    This alert triggers when at least one NAT rule is unable to allocate enough resources for translation.
    Raise Condition
    This incident is raised if the rate of change for the 'flow_fpp_nat_dipp_max_retries' counter OR the 'flow_policy_nat' counter exceeds the configured threshold persistently for a duration of 1 hour.
    Clear Condition
    This incident will be cleared only if the rate of change for the triggering counter remains continuously below the defined threshold for a full 4-hour period.

    Incident: NAT Pool Usage

    Incident Code
    INC_NGFW_NAT_POOL_USAGE
    Category
    Device
    Subcategory
    System Resources
    Description
    This alert triggers when one or more NAT rules have high resource usage.
    Raise Condition
    When any NAT Policy pool usage exceeds 85% of its max limit for at least 1 hour and is recurring at least 2 times in the past ( so in total 3 such occurrences )
    Clear Condition
    When any NAT Policy pool usage is less than 85% of its max limit for at least 4 hour

    Incident: Out Of Sync HA Peers - Configuration

    Incident Code
    INC_NGFW_OUT_OF_SYNC_PEERS_CONFIGURATION
    Category
    Device
    Subcategory
    High Availability
    Description
    This incident indicates a configuration discrepancy between High Availability (HA) peers, primarily due to the "Enable Config Sync" option being disabled in the High Availability General settings.
    Raise Condition
    Running config file between the HA pair of devices is not synchronized for 2 hours
    Clear Condition
    If the running configuration is in sync with the peer device for at least 4 hours.

    Incident: Out of Sync Peers - Dynamic Content

    Incident Code
    INC_NGFW_OUT_OF_SYNC_PEERS_DYNAMIC_CONTENT
    Category
    Device
    Subcategory
    High Availability
    Description
    This incident triggers when dynamic content, such as Applications, Threats, or Antivirus versions, is not synchronized between firewalls in a high-availability (HA) pair.
    Raise Condition
    If Dynamic Content ( Anti virus, Apps and Threat) is Out of Sync between HA Peers for 1 week.
    Clear Condition
    If the Dynamic content between the HA peers are not outdated for 1 week.

    Incident: Out of Sync Peers - Sessions

    Incident Code
    INC_NGFW_OUT_OF_SYNC_SESSIONS
    Category
    Device
    Subcategory
    High Availability
    Description
    Sessions are not matching or up to date between the High availability Peers.
    Raise Condition
    When HA2 data link interface (dedicated HA communication interface) is not configured
    Clear Condition
    When HA2 data link interface (dedicated HA communication interface) is configured

    Incident: Out of Sync Peers - Software

    Incident Code
    INC_NGFW_OUT_OF_SYNC_PEERS_SW
    Category
    Device
    Subcategory
    High Availability
    Description
    The PAN-OS software versions on the high availability peers do not match.
    Raise Condition
    When the PAN-OS software versions on the High Availability (HA) peers do not match.
    Clear Condition
    When the PAN-OS software versions on the High Availability (HA) peers match.

    Incident: Outdated Dynamic Content - Antivirus

    Incident Code
    INC_NGFW_OUTDATED_DYNAMIC_CONTENT_ANTIVIRUS
    Category
    Device
    Subcategory
    Management
    Description
    The dynamic content installed on your device is outdated compared to the latest version available on the update server. This means your device isn't leveraging the most current security intelligence.
    Raise Condition
    This incident is raised when the system fails to update its Antivirus dynamic content. The failure can occur during either the download process from the update server or during the subsequent installation of the downloaded content. The device may not have the latest threat intelligence protections provided by the Antivirus package.
    Clear Condition
    This incident will clear automatically once the Antivirus dynamic content has been successfully downloaded and installed on the system. When the device confirms a successful update, the incident will be resolved, indicating that threat intelligence is current.

    Incident: Outdated Dynamic Content - Apps and Threats

    Incident Code
    INC_NGFW_OUTDATED_DYNAMIC_CONTENT_APPSANDTHREATS
    Category
    Device
    Subcategory
    Management
    Description
    The dynamic content installed on your device is outdated compared to the latest version available on the update server. This means your device isn't leveraging the most current security intelligence.
    Raise Condition
    This incident is raised when the system fails to update its Apps and Threat dynamic content. The failure can occur during either the download process from the update server or during the subsequent installation of the downloaded content. The device may not have the latest threat intelligence protections provided by the Apps and Threat content package.
    Clear Condition
    This incident will clear automatically once the Apps and Threat dynamic content has been successfully downloaded and installed on the system. When the device confirms a successful update, the incident will be resolved, indicating that threat intelligence is current.

    Incident: Outdated Dynamic Content - Wildfire

    Incident Code
    INC_NGFW_OUTDATED_DYNAMIC_CONTENT_WILDFIRE
    Category
    Device
    Subcategory
    Management
    Description
    The dynamic content installed on your device is outdated compared to the latest version available on the update server. This means your device isn't leveraging the most current security intelligence.
    Raise Condition
    This incident is raised when the system fails to update its WildFire dynamic content. The failure can occur during either the download process from the update server or during the subsequent installation of the downloaded content. The device may not have the latest threat intelligence protections provided by the WildFire package.
    Clear Condition
    This incident will clear automatically once the WildFire dynamic content has been successfully downloaded and installed on the system. When the device confirms a successful update, the incident will be resolved, indicating that threat intelligence is current.

    Incident: PAN-OS End-of-Life

    Incident Code
    INC_NGFW_END_OF_LIFE_SOFTWARE
    Category
    Device
    Subcategory
    EOL/EOS
    Description
    Your current version of PAN-OS is no longer supported.
    Raise Condition
    When End of life for software is less than 90 days
    Clear Condition
    When End of life for software is more than 90 days

    Incident: PAN-OS Known Vulnerability

    Incident Code
    INC_NGFW_PANOS_KNOWN_VULNERABILITY_EXCEEDED_VALUE
    Category
    Device
    Subcategory
    Vulnerability
    Description
    Your current version of PAN-OS has known vulnerabilities.
    Raise Condition
    If the Firewall SW version is part of the CVE Affected versions based on CVE severity score greater than or equal to 7. Ex: CVE reference and link - https://security.paloaltonetworks.com/CVE-2024-5913"
    Clear Condition
    If the CVEs have the CVE severity score less than 7

    Incident: PAN-OS integrated User-ID Agent Monitored Server Disconnected

    Incident Code
    INC_NGFW_USER_ID_AGENT_DISCONNECTION
    Category
    Network Services
    Subcategory
    User-ID
    Description
    This alert is triggered when the server, monitored by the PAN-OS integrated User-ID Agent (Agentless User-ID), loses connection with the firewall. This monitored server is a critical component for mapping user identities to network activities.
    Raise Condition
    When the User ID agent is disconnected
    Clear Condition
    When all User ID agents are connected

    Incident: Path Monitor Failure - Card

    Incident Code
    INC_NGFW_PATH_MON_FAIL_CARD
    Category
    Device
    Subcategory
    Hardware
    Description
    A path monitoring failure has been detected on a card located within the firewall's slots.
    Raise Condition
    Path monitor failure detected
    Clear Condition
    Path monitor failure cleared

    Incident: Reduced Log Forwarding Detected

    Incident Code
    INC_NGFW_REDUCED_LOG_FORWARDING
    Category
    Network Services
    Subcategory
    Logging
    Description
    This alert triggers when the NGFW's log-receiver fills up, causing it to drop logs. This issue can stem from several factors, including: • A network connectivity problem to an external logging service (like a Log collector, syslog, SNMP, email server). • An issue with the external logging service itself, such as it being offline or unable to process incoming logs. • A resource constraint on the NGFW or the external logging service, such as high CPU or memory utilization. When this occurs, a significant portion of the NGFW's log data isn't forwarded to its intended destination.
    Raise Condition
    When logs fail to get forwarded to its respective destination for 1 hours
    Clear Condition
    When the logs are getting forwarded and there is no delay or loss in log forwarding for at least 4 hours
    Probable Root Cause Incident
    "INC_NGFW_DISK_HINT_OVERFLOW_LOG_FWD_FAIL",
    "INC_NGFW_LOG_FORWARDING_DISABLED_DUE_TO_SNMP_SERVER_UNRESOLVED_HOSTNAME",
    "INC_NGFW_LOG_FWD_MISSING_COLLECTOR_PREF",
    "INC_NGFW_LOG_FWD_DELAY"

    Incident: Redundant Power Supply Failure

    Incident Code
    INC_NGFW_POWER_SUPPLY_FAILED
    Category
    Device
    Subcategory
    Hardware
    Description
    This incident triggers when a firewall has insufficient power supplies installed to meet redundancy requirements.
    Raise Condition
    Redundancy requirements are not met because the firewall has fewer operational power supplies than required for full power redundancy.
    Clear Condition
    Power redundancy requirements are fully met, with the required number of operational power supplies installed and functioning.

    Incident: Thermal Issues

    Incident Code
    INC_NGFW_ENV_THERMAL_ISSUE
    Category
    Device
    Subcategory
    Hardware
    Description
    This incident triggers when the device temperature exceeds the defined operational range.
    Raise Condition
    When the Temperature exceeds the optimal operating range for any component and stays above the range for at least 2 hours
    Clear Condition
    When the Temperature comes back to the optimal operating range and stays there for at least 2 hours for any components

    Incident: URLs or IPs with EDLs Approaching Max Limits

    Incident Code
    INC_NGFW_CONFIG_EDL_USAGE
    Category
    Device
    Subcategory
    System Resources
    Description
    The number of URLs, IPs, or Domains within the configured EDL(s) used in policy on this firewall is approaching the maximum capacity that the firewall can support.
    Raise Condition
    When URL or IP EDL usages exceed 95% of the capacity for that firewall model and remain above 95% for five days within a week.
    Clear Condition
    When URL or IP EDL usages fall below 95% of the capacity for that firewall model and stay below 95% for two weeks.

    © 2025 Palo Alto Networks, Inc. All rights reserved.