>
    Strata Copilot
    Incidents in Strata Cloud Manager Reference
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Manage NGFW Incidents
    4. Incidents in Strata Cloud Manager Reference
    Download PDF
    Next-Generation Firewall

    Incidents in Strata Cloud Manager Reference

    Table of Contents

    Incidents in Strata Cloud Manager Reference

    This topic provides details of the NGFW incidents in Strata Cloud Manager.

    Incident: Approaching High Session Table Utilization

    Incident Code
    INC_NGFW_RESOURCES_SESSION_TABLE_USAGE
    Category
    Device
    Subcategory
    System Resources
    Description
    Approaching High Session Table Utilization
    Raise Condition
    When Session Table Utilization exceeds 85% of usage for 20 minutes
    Clear Condition
    When Session Table Utilization is less than 85% of usage for 2 hours

    Incident: Approaching Max Capacity - ARP Table Entries

    Incident Code
    INC_NGFW_CAPACITY_ARP_TABLE_SIZE
    Category
    Device
    Subcategory
    System Resources
    Description
    Data forecasting analysis shows that the ARP Table entries are on track to reach the firewall's maximum capacity soon.
    Raise Condition
    When ARP Table size usage exceed 90% of the capacity of that respective firewall model and stays beyond 90% for five days over a week
    Clear Condition
    When ARP Table size usage falls below 90% of the capacity of that respective firewall model and stays below 90% for two weeks

    Incident: Approaching Max Capacity - Address Groups

    Incident Code
    INC_NGFW_CAPACITY_ADDRESS_GROUPS
    Category
    Device
    Subcategory
    System Resources
    Description
    The number of address group objects has been consistently high and is approaching the maximum capacity the firewall can support.
    Raise Condition
    When Address Groups usage exceed 90% of the capacity of that respective firewall model and stays beyond 90% for five days over a week AND When there are only 2500 or less address groups available to be used for five days over a week
    Clear Condition
    When Address Groups usage falls below 90% of the capacity of that respective firewall model and stays below 90% for two weeks OR When there are more than 2500 address groups available to be used for two weeks

    Incident: Approaching Max Capacity - Address Objects

    Incident Code
    INC_NGFW_CAPACITY_ADDRESS_OBJECTS
    Category
    Device
    Subcategory
    System Resources
    Description
    The number of address objects has been consistently high and is approaching the maximum capacity the firewall can support.
    Raise Condition
    When Address Objects usage exceed 90% of the capacity of that respective firewall model and stays beyond 90% for five days over a week AND When there are only 5000 or less address objects available to be used for five days over a week
    Clear Condition
    When Address Objects usage falls below 90% of the capacity of that respective firewall model and stays below 90% for two weeks OR When there are more than 5000 address objects available to be used for two weeks

    Incident: Approaching Max Capacity - Configuration Size

    Incident Code
    INC_NGFW_RESOURCES_CONFIG_SIZE_USAGE
    Category
    Device
    Subcategory
    System Resources
    Description
    This incident triggers when the configuration file size approaches the maximum supported capacity, indicating that the device is nearing its configuration storage limit.
    Raise Condition
    When the firewall configuration size reaches 90% of the device recommended configuration size limit and sustains for 3 days staying at 90% or more
    Clear Condition
    When the firewall configuration size is less than 90% of the device recommended configuration size limit for that respective model and stays less than 90% for 3 days

    Incident: Approaching Max Capacity - Connections Per Second(CPS)

    Incident Code
    INC_NGFW_CAPACITY_CONNECTIONS_PER_SECOND
    Category
    Device
    Subcategory
    System Resources
    Description
    The firewall has anomalous values for connections per second (CPS).
    Raise Condition
    When Connections Per Second(CPS) usage exceed 90% of the capacity of that respective firewall model and stays beyond 90% for five days in a week
    Clear Condition
    When Connections Per Second(CPS) usage falls below 90% of the capacity of that respective firewall model and stays below 90% for 1 week

    Incident: Approaching Max Capacity - FQDN Addresses

    Incident Code
    INC_NGFW_CAPACITY_FQDN_ADDRESSES
    Category
    Device
    Subcategory
    System Resources
    Description
    The number of FQDN address objects has been consistently high and is approaching the maximum capacity the firewall can support.
    Raise Condition
    When FQDN Addresses usage exceed 90% of the capacity of that respective firewall model and stays beyond 90% for five days over a week
    Clear Condition
    When FQDN Addresses usage falls below 90% of the capacity of that respective firewall model and stays below 90% for two weeks

    Incident: Approaching Max Capacity - Management Plane Memory

    Incident Code
    INC_NGFW_CAPACITY_MANAGEMENT_PLANE_MEMORY
    Category
    Device
    Subcategory
    System Resources
    Description
    The management plane (MP) Memory usage has been consistently high and is approaching the maximum capacity the device can support.
    Raise Condition
    When we detect that the MP Memory usage has exceeded 90% or higher at least 3 times a day for 5 days over a week
    Clear Condition
    When we detect that the MP Memory usage is less than 90% for two weeks

    Incident: Approaching Max Capacity - Security Policies

    Incident Code
    INC_NGFW_CAPACITY_SECURITY_POLICIES
    Category
    Device
    Subcategory
    System Resources
    Description
    The number of security policy rules has been consistently high and is approaching the maximum capacity the firewall can support.
    Raise Condition
    When Security Policies usage exceed 90% of the capacity of that respective firewall model and stays beyond 90% for five days in a week AND When there are only 1500 or less Security Policies available to be used for five days over a week
    Clear Condition
    When Security Policies usage falls below 90% of the capacity of that respective firewall model and stays below 90% for two weeks AND When there are more than 1500 security policies available to be used for two weeks

    Incident: Approaching Max Capacity - Service Objects

    Incident Code
    INC_NGFW_CAPACITY_SERVICE_OBJECTS
    Category
    Device
    Subcategory
    System Resources
    Description
    The number of service objects has been consistently high and is approaching the maximum capacity the firewall can support.
    Raise Condition
    When Service Objects usage exceed 90% of the capacity of that respective firewall model and stays beyond 90% for five days over a week
    Clear Condition
    When Service Objects usage falls below 90% of the capacity of that respective firewall model and stays below 90% for two weeks

    Incident: Approaching Max Capacity - Session Table Utilization

    Incident Code
    INC_NGFW_CAPACITY_SESSION_TABLE_UTILIZATION
    Category
    Device
    Subcategory
    System Resources
    Description
    Approaching MAX Capacity: High Session Table Utilization
    Raise Condition
    When Session Table Utilization exceed 90% of the capacity of that respective firewall model and stays beyond 90% for five days over a week
    Clear Condition
    When Session Table Utilization falls below 90% of the capacity of that respective firewall model and stays below 90% for two weeks

    Incident: Approaching Max Capacity - System Throughput

    Incident Code
    INC_NGFW_CAPACITY_SYSTEM_THROUGHPUT
    Category
    Device
    Subcategory
    System Resources
    Description
    The firewall has anomalous values for throughput.
    Raise Condition
    When System Throughput usage exceed 90% of Threat Prevention throughput capacity of that respective firewall model and stays beyond 90% for five days in a week
    Clear Condition
    When System Throughput usage falls below 90% of Threat Prevention throughput capacity of that respective firewall model and stays below 90% for 1 week

    Incident: Card Failure: Card start timeout - Max restarts attempted

    Incident Code
    INC_NGFW_CARD_FAILURE_START_TIMEOUT
    Category
    Device
    Subcategory
    Hardware
    Description
    This alert triggers when the error "Card start timeout - Max restarts attempted" is detected in one of the line cards in the chassis, indicating a software or hardware issue that has caused the card to enter a failure state.
    Raise Condition
    This incident is raised if the log message indicating that a card has experienced “Card start timeout - Max restarts attempted” is detected at least once within a one-hour window.
    Clear Condition
    This incident is cleared when the log message indicating that the card is up is detected.

    Incident: Card Failure: Path monitor failure - Max restarts attempted

    Incident Code
    INC_NGFW_CARD_FAILURE_PATH_MONITOR_MAX_RESTARTS
    Category
    Device
    Subcategory
    Hardware
    Description
    This alert triggers when the error "Path monitor failure - Max restarts attempted" is detected in one of the line cards in the chassis, indicating a software or hardware issue that has caused the card to enter a failure state.
    Raise Condition
    This incident is raised if the log message indicating that a card has experienced a “Path monitor failure - Max restarts attempted” is detected at least once within a one-hour window.
    Clear Condition
    This incident is cleared when the log message indicating that the card is up is detected.

    Incident: Card Power Failure

    Incident Code
    INC_NGFW_CARD_POWER_FAIL
    Category
    Device
    Subcategory
    Hardware
    Description
    A card failure has been detected, suggesting a potential issue with the card or its seating within the chassis.
    Raise Condition
    Card power failure has been detected.
    Clear Condition
    Card power failure is no longer detected.

    Incident: Card Stuck in Starting State

    Incident Code
    INC_NGFW_CARD_STUCK_IN_STARTING_STATE
    Category
    Device
    Subcategory
    Hardware
    Description
    This alert detects if a card is stuck in "Starting" state.
    Raise Condition
    This incident is raised if the log message indicating that the card is starting is detected at least four times within a 90 minutes window.
    Clear Condition
    This incident is cleared when the log message indicating that the card is up is detected.

    Incident: Card failure with reason "Slot runtime software failure - Max restarts attempted"

    Incident Code
    INC_NGFW_CARD_FAILURE_SW_MAX_RESTARTS
    Category
    Device
    Subcategory
    Hardware
    Description
    This alert triggers when the error "Slot runtime software failure - Max restarts attempted" is detected in one of the line cards in the chassis, indicating a software or hardware issue that has caused the card to enter a failure state.
    Raise Condition
    This incident is raised if the log message indicating that a card has experienced a “Slot runtime software failure – Max restarts attempted” is detected at least once within a one-hour window.
    Clear Condition
    This incident is cleared when the log message indicating that the card is up is detected.

    Incident: Certificate Expiration

    Incident Code
    INC_NGFW_CERTIFICATE_EXPIRY_EXCEEDED_THRESHOLD
    Category
    Device
    Subcategory
    Management
    Description
    One or more certificate(s) on the firewall have been revoked or are expiring soon.
    Raise Condition
    This incident is raised when the certificate in question has to be renewed in less than 60 days
    Clear Condition
    The incident is cleared when the certificate's renewal data is above 60 days (such as when the certificate is renewed)

    Incident: Config Memory Usage Approaching Max Limits

    Incident Code
    INC_NGFW_CONFIG_MEMORY_USAGE
    Category
    Device
    Subcategory
    System Resources
    Description
    The firewall's configuration is approaching its maximum memory usage limit. During commits, the firewall's total config memory must accommodate two copies: the current 'in-use' configuration and the new 'to-be-used' configuration. If the allocated memory per configuration exceeds 50%, the firewall reaches capacity, resulting in commit failure.
    Raise Condition
    When configuration memory usage exceed 90% of the capacity of that respective firewall model and stays beyond 90% for five days over a week.
    Clear Condition
    When configuration memory usage falls below 90% of the capacity of that respective firewall model and stays below 90% for two weeks.

    Incident: DHCP Client IPv4 address Assignment Failure

    Incident Code
    INC_NGFW_DHCP_CLIENT_IPV4_ASSIGN_FAIL
    Category
    Device
    Subcategory
    Management
    Description
    This alert is triggered when a firewall?s dataplane interface configured as an IPv4 DHCP client either fails to obtain an IP address or has lost its assigned IP address.
    Raise Condition
    This incident is raised if a log message indicates that a firewall interface configured as a DHCP client did not receive an IP address or its assigned IP address has been cleared.
    Clear Condition
    This incident is cleared when the firewall interface configured as a DHCP client is successfully assigned an IP address.

    Incident: Degraded System Drive

    Incident Code
    INC_NGFW_SYSTEM_DRIVE_ISSUE
    Category
    Device
    Subcategory
    Hardware
    Description
    A degraded system drive has been identified by monitoring its attributes values.
    Raise Condition
    Degraded system drive has been detected
    Clear Condition
    No degraded system drive detected

    Incident: Delayed Telemetry

    Incident Code
    INC_NGFW_DELAYED_TELEMETRY
    Category
    Device
    Subcategory
    Management
    Description
    The analytics engines have no new telemetry from this NGFW/Panorama.
    Raise Condition
    When the telemetry is not received for at least 12 consecutive hours
    Clear Condition
    When telemetry has been received within the last 12 hours

    Incident: Device in HA Pair Transitioned to Unhealthy State

    Incident Code
    INC_NGFW_HA_STATE_TRANSITIONED_UNHEALTHY
    Category
    Device
    Subcategory
    High Availability
    Description
    This incident triggers when a firewall or Panorama in a high availability (HA) pair transitions to an unhealthy state, such as Initial, Suspended, Non-Functional, or Tentative. These states indicate that the device may be unable to perform normal operations, maintain HA synchronization, or communicate effectively with peers or management systems.
    Raise Condition
    An alert is triggered when a member of the HA pair transitions into a non-operational state ( Suspended, Non-Functional).
    Clear Condition
    The alert is cleared when the HA member transitions to a healthy state (Passive, Active, Active-Primary, or Active-Secondary).
    Probable Root Cause Incident
    "INC_NGFW_HA_NON_FUNCTIONAL_DU_TO_LINK_DOWN",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_BRDAGENT_EXITING",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_DEVICE_ID_OVERLAP",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_DP_DOWN",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_DP_DOWN_BRDAGENT_EXISTING",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_DRIVE_ERROR",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_HA1_AP_MISMATCH",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_MULTI_VSYS_MISMATCH",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_PEER_VERSION_OLD",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_POLICY_PUSH_FAIL_TO_DP",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_PREEMPTION_LOOP",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_STATE_SYNC_MISMATCH",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_VENDOR_URL_MISMATCH",
    "INC_NGFW_HA_NON_FUNCTIONAL_DUE_TO_WAITING_POLICY_PUSH_TO_DP",
    "INC_NGFW_HA_NON_FUNCTIONAL_STATE_DUE_TO_PATH_DOWN"

    Incident: Duplicate IP address detected on an interface

    Incident Code
    INC_NGFW_DUPLICATE_IP_ADDRESS
    Category
    Network and Traffic
    Subcategory
    Interface
    Description
    This incident is triggered when a duplicate IP address is detected. The firewall's configuration can cause IP address conflicts on the network if any of the following conditions apply: 1. One of the firewall's interfaces has the same IP address. 2. A static Source Network Address Translation (SNAT) address is assigned that conflicts. 3. A static Destination Network Address Translation (DNAT) address is assigned that conflicts. 4. An IP address from a configured SNAT pool overlaps an existing subnet. 2. The IdP may fail to transmit the SAML assertion due to misconfiguration. This Incident automatically clears if no new errors are noticed for 24 hours since the detection of the duplicate IP address.
    Raise Condition
    This incident is triggered by the detection of at least one log message indicating a duplicate IP address (resulting from a conflicting received ARP).
    Clear Condition
    The alert will be cleared after 24 hours if no further duplicate IP logs are detected.

    Incident: Ethernet Interface Down

    Incident Code
    INC_NGFW_ETHERNET_INTERFACE_DOWN
    Category
    Network and Traffic
    Subcategory
    Interface
    Description
    This alert triggers if the firewall has detected that a dataplane ethernet interface is down.
    Raise Condition
    This incident is raised when one or more firewall Ethernet interfaces are down (forced or autoneg), indicating a potential link or configuration issue.
    Clear Condition
    This incident is cleared when none of the firewal Ethernet interface is down (forced or autoneg).

    Incident: FE100 Failure

    Incident Code
    INC_NGFW_FE_100_FAILURE
    Category
    Device
    Subcategory
    Hardware
    Description
    A calibration error has been detected on the FE100 chip in the firewall. This issue usually indicates a hardware failure.
    Raise Condition
    Detected Calibration Error
    Clear Condition
    FE100 calibration errors cleared

    Incident: Fan Issues

    Incident Code
    INC_NGFW_ENV_FAN_ISSUES
    Category
    Device
    Subcategory
    Hardware
    Description
    A fan or fan tray triggered an alarm on the device.
    Raise Condition
    When any one of the fan fails to operate in its optimal range of revolutions per minute(RPM) for at least two hours
    Clear Condition
    When fan is operating in its optimal range of RPM for at least 12 hours

    Incident: Fatal Machine Check Failure

    Incident Code
    INC_NGFW_MACHINE_CHECK_FAIL
    Category
    Device
    Subcategory
    Hardware
    Description
    A Fatal Machine check failure was detected. This issue usually indicates a hardware failure in the CPU.
    Raise Condition
    Detected Kernel Panic - Not Syncing Fatal Machine check exceptions
    Clear Condition
    No Fatal Machine Check Exceptions

    Incident: Firewall HA Failover

    Incident Code
    INC_NGFW_HA_FAILOVER
    Category
    Device
    Subcategory
    High Availability
    Description
    This incident triggers when a device in an HA pair undergoes a failover, causing the secondary device to assume the active role. This may indicate a disruption in the primary device or a configuration or environmental issue that triggered the HA state transition.
    Raise Condition
    When a device (NGFW or Panorama) unexpectedly fails over.
    Clear Condition
    Monitor for 3 days to clear the incident if there is no other High availability failover event in this duration. If in this 3 days if another HA failover event occurs then the 3 day timer begins again.

    Incident: Firewall losing logs

    Incident Code
    INC_NGFW_LOG_LOSS
    Category
    Network Services
    Subcategory
    Logging
    Description
    This alert indicates that DP logs (such as traffic, threat, URL, Netflow, User-ID, GP, Decryption, EAL, etc.) that are supposed to be generated based on inspected traffic and logging configurations are being lost. When logs are generated in the DP, they are moved into logging queues, which are then handed over to the logrcvr in the Management Plane (DP to MP). To prevent the DP-to-MP channel from being overwhelmed, a rate-limiting mechanism was implemented to control the transfer of logs from the Data Plane to the Management Plane. This mechanism regulates either the logging count rate (logs/sec) or bandwidth usage (KB/sec). The control is in place to ensure that other services such as packet capture and any requests from DP to the cloud (e.g., URL, Wildfire, etc.), are not dropped due to excessive logging bandwidth consumption.
    Raise Condition
    Firewall is losing logs at dataplane and logs losing rate is greater than 50 logs per second at least for an hour. OR Dataplane(DP) to Management plane(MP) logs overflow and logs are lost due to rate-limiting between DP and MP.
    Clear Condition
    When the logs are being generated, retained and are not lost for 24 hr duration.
    Probable Root Cause Incident
    "INC_NGFW_FAILED_TO_SCHEDULE_A_LOG_FWD_CONTROL_JOB_FOR_DEVICE",
    "INC_NGFW_FSM_INIT_FAILED",
    "INC_NGFW_HIGH_LOG_RATE",
    "INC_NGFW_INTER_LOG_COLLECTOR_DISCONNECT",
    "INC_NGFW_LICENSE_NOT_PROVISIONED_LCAAS",
    "INC_NGFW_LOG_CERT_MISMATCH",
    "INC_NGFW_PAN_LC_DISCONNECTED_FROM_GROUP",
    "INC_NGFW_SYSLOG_CONN_LOST",
    "INC_NGFW_TCP_CONN_SYSLOG",
    "INC_NGFW_DROPPING_LOGS_FWD_QUEUE_FAIL"

    Incident: HA Backup

    Incident Code
    INC_NGFW_BACK_UP_LINK_NOT_CONFIGURED
    Category
    Device
    Subcategory
    High Availability
    Description
    The HA Backup link(s) are not currently configured.
    Raise Condition
    When either the HA1-backup or HA2-backup links are not configured
    Clear Condition
    When HA1-backup and HA2-backup links are configured

    Incident: HA Link Issue Detected

    Incident Code
    INC_NGFW_HA_LINK_ISSUE
    Category
    Device
    Subcategory
    High Availability
    Description
    This incident triggers when a change is detected in the status of one or more HA(High Availability) links between firewall peers. These links are critical for synchronizing session information, configuration, and state data. A status change may indicate that one or more HA links are down or unstable.
    Raise Condition
    When HA link status goes down. HA links are links that are configured for HA functionality ( HA1, HA1-backup HA2, HA2-backup, HA3)
    Clear Condition
    When the HA link has come back up and stays in up state atleast for 2 hours
    Probable Root Cause Incident
    "INC_NGFW_HA_OR_HA1_BACKUP_LINK_CONNECTION_FAILURE",
    "INC_NGFW_HA_OR_HA2_BACKUP_KEEP_ALIVES_DOWN"

    Incident: HA Peer Connection Status

    Incident Code
    INC_NGFW_HA_PEER_STATUS
    Category
    Device
    Subcategory
    High Availability
    Description
    One of the firewalls in the HA pair is in a non-healthy state.
    Raise Condition
    If the connection status for peer is down
    Clear Condition
    If connection status for peer is healthy

    Incident: High Dataplane CPU Activity Detected

    Incident Code
    INC_NGFW_DP_CPU_USAGE_EXCEEDED_THRESHOLD
    Category
    Device
    Subcategory
    System Resources
    Description
    High Dataplane CPU Activity Detected
    Raise Condition
    MAX DP CPU exceeds 95% for 15 minutes OR AVG DP CPU exceeds 85% for 1 hour
    Clear Condition
    Clears when MAX DP CPU stays below 95% and AVG DP CPU stays below 85% continuously for at least 2 hours.

    Incident: High Disk Space Usage - Pancfg Partition

    Incident Code
    INC_NGFW_DISK_RESOURCES_USAGE_PANCFG_PARTITION
    Category
    Device
    Subcategory
    System Resources
    Description
    This incident triggers when the disk space usage in the pancfg partition exceeds the defined threshold, indicating that the partition is running low on available storage capacity.
    Raise Condition
    If pancfg partition usage reaches 90% and stays there for at least 2 hours
    Clear Condition
    If pancfg partition usage is less than 90% and stays there for at least 12 hours

    Incident: High Disk Space Usage - Panlogs Partition

    Incident Code
    INC_NGFW_DISK_RESOURCES_USAGE_PANLOGS_PARTITION
    Category
    Device
    Subcategory
    System Resources
    Description
    This incident triggers when the disk space usage in the panlogs partition exceeds the defined threshold, indicating that the partition is running low on available storage capacity.
    Raise Condition
    If it reaches 97% usage and stays there for at least 6 hours.
    Clear Condition
    Less than 97% usage and stays there for at least 12 hours

    Incident: High Disk Space Usage - Shared memory partition

    Incident Code
    INC_NGFW_HIGH_DISK_USAGE_SHARED_MEM
    Category
    Device
    Subcategory
    System Resources
    Description
    This alert is triggered if the shared memory (/dev/shm) disk partition is full on a firewall. The /dev/shm is a temporary filesystem used for shared memory in Linux systems.
    Raise Condition
    This incident is raised when the shared memory partition exceeds 90% of the firewall’s capacity and remains above 90% for one hour.
    Clear Condition
    The incident is cleared when the shared memory partition falls below 85% of the firewall’s capacity and remains below 85% for one hour.

    Incident: High Disk Space Usage on Root Partition

    Incident Code
    INC_NGFW_DISK_RESOURCES_ROOT_PARTITION_USAGE
    Category
    Device
    Subcategory
    System Resources
    Description
    This incident triggers when the disk space usage in the root partition exceeds the defined threshold, indicating that the partition is running low on available storage capacity.
    Raise Condition
    If the root partition in the disk exceeds 95% usage and stays there for at least 2 hours
    Clear Condition
    If the root partition is less than 95% usage and stays there for at least 12 hours

    Incident: High Management Plane CPU Activity Detected

    Incident Code
    INC_NGFW_MP_CPU_USAGE_EXCEEDED_THRESHOLD
    Category
    Device
    Subcategory
    System Resources
    Description
    High Management Plane CPU Activity Detected
    Raise Condition
    If the MP CPU usage goes beyond 95% and stays there for at least 15 minutes
    Clear Condition
    If the MP CPU usage is below 95% for at least 2 hours

    Incident: High Management Plane Memory Usage

    Incident Code
    INC_NGFW_MP_MEMORY_USAGE_EXCEEDED_THRESHOLD
    Category
    Device
    Subcategory
    System Resources
    Description
    High Management Plane memory usage has been detected.
    Raise Condition
    If the MP Memory usage goes beyond 95% and stays there for at least 20 minutes
    Clear Condition
    If the MP Memory usage is below 95% and stays there for at least 2 hours

    Incident: High Traffic Volume Detected - Connections Per Second

    Incident Code
    INC_NGFW_SYSTEM_CONNECTIONS_PER_SECOND
    Category
    Device
    Subcategory
    System Resources
    Description
    The firewall has anomalous values for connections per second (CPS).
    Raise Condition
    Based on Firewall model type if the Connections per second(CPS) is above 95% of what is possible on that model for 15mins
    Clear Condition
    Based on Firewall model type if the Connections per second(CPS) is less than 95% of what is possible on that model for 2 hours

    Incident: High Traffic Volume Detected - System Throughput

    Incident Code
    INC_NGFW_SYSTEM_THROUGHPUT
    Category
    Device
    Subcategory
    System Resources
    Description
    The firewall has anomalous values for throughput.
    Raise Condition
    Based on Firewall model type if the firewall Throughput is above 95% of Threat prevention thorughput of what is possible on that model for 15mins
    Clear Condition
    Based on Firewall model type if the Throughput is less than 95% of Threat prevention thorughput of what is possible on that model for 2 hours

    Incident: Incompatible SFP Media Type

    Incident Code
    INC_NGFW_INCOMPATIBLE_SFP_MEDIA_TYPE
    Category
    Device
    Subcategory
    Hardware
    Description
    This alert triggers when the error "SFP Ports Doesn't Support this media type" is found in the device, indicating an incompatible or faulty SFP or cable is inserted.
    Raise Condition
    This incident is raised if the error "SFP Ports Doesn't Support this media type" is found in the device.
    Clear Condition
    This incident is cleared if the error "SFP Ports Doesn't Support this media type" is no longer occurring in the device.

    Incident: Increased Traffic Latency - Packet Descriptor

    Incident Code
    INC_NGFW_PACKET_DESCRIPTORS_USAGE_EXCEEDED_THRESHOLD
    Category
    Device
    Subcategory
    System Resources
    Description
    Packet Descriptor resources are running low on the device.
    Raise Condition
    If the Packet Descriptors usage exceeds 90% usage and stays there for 10 minutes
    Clear Condition
    If the Packet Descriptors usage is less than 90% usage for at least 4 hours

    Incident: Irregular Input Power

    Incident Code
    INC_NGFW_POWER_RAIL_FAILURE
    Category
    Device
    Subcategory
    Hardware
    Description
    Device power levels are outside of the normal range.
    Raise Condition
    In the output of "show system environmentals" CLI, the alarm flag is True for 4 hours
    Clear Condition
    If the alarm flag is false for 24 hours

    Incident: License Expiration

    Incident Code
    INC_NGFW_LICENSE_EXPIRY_EXCEEDED_THRESHOLD
    Category
    Device
    Subcategory
    Management
    Description
    One or more of your licenses are nearing or have reached expiration.
    Raise Condition
    This incident is raised when a software or feature license is nearing its expiration date. By default, this incident is generated if the license is due to expire within 90 days.
    Clear Condition
    This incident will be automatically cleared once the license has been successfully renewed or updated. The condition is met when the system verifies that the new license expiration date is more than 90 days in the future.

    Incident: Logging Drive Failure

    Incident Code
    INC_NGFW_LOG_DRIVE_FAIL
    Category
    Device
    Subcategory
    Hardware
    Description
    A failed logging drive has been identified through the monitoring of the firewall's disk status.
    Raise Condition
    Detected Logging Drive Failure on disk
    Clear Condition
    Logging Drive Failure is cleared

    Incident: Logrcvr Out-of-Memory - LFC Log Loss Recovery Mechanism

    Incident Code
    INC_NGFW_PA7050_SLOT8_PATH_MON_FAIL_OOM
    Category
    Device
    Subcategory
    System Resources
    Description
    This alert indicates that a connection to the Log Collector, Panorama or Strata Logging Service is unstable, causing increased memory usage for the LFC log loss recovery hint mechanism.
    Raise Condition
    Connection to the Log Collector, Panorama or Strata Logging Service is unstable
    Clear Condition
    Connection to the Log Collector, Panorama or Strata Logging Service become stable

    Incident: MP Process Memory Depletion

    Incident Code
    INC_NGFW_MP_PROCESS_MEMORY_DEPLETION
    Category
    Device
    Subcategory
    System Resources
    Description
    This incident triggers when a Management Plane (MP) process on the firewall consumes excessive memory without releasing it, which may indicate a memory leak or abnormal behavior.
    Raise Condition
    Triggers when leak conditions are detected in more than 75% of the last 4 hours.
    Clear Condition
    Clears when the average MP system memory usage of the last 10 hours is below 60%, or when non-leak conditions occur in more than 75% of the last 4 hours.

    Incident: MPC Card - CPLD Failure

    Incident Code
    INC_NGFW_MPC_CPLD_FAILURE
    Category
    Device
    Subcategory
    Hardware
    Description
    The Management Processor Card (MPC) is an essential component for the PA-5450, providing management, logging, and high availability functions. The MPC card has experienced a failure due to an issue with its component, the Complex Programmable Logic Device (CPLD).
    Raise Condition
    Detected CPLD - CPU catastrophic error
    Clear Condition
    CPLD - CPU catastrophic errors cleared

    Incident: Mismatch of Server Group Mapping Users and Groups between LDAP and PAN-OS Device

    Incident Code
    INC_NGFW_GROUP_MAPPING_UPDATE_INTERRUPTED
    Category
    Network Services
    Subcategory
    User-ID
    Description
    This alert indicates that users and groups defined through LDAP server group mapping are missing on the PAN-OS device, even though they are correctly configured in the LDAP server. It may also indicate that users and groups have not been removed from the PAN-OS device, despite being deleted from the LDAP server.
    Raise Condition
    Incident raises when LDAP group mapping update encounters errors unrelated to LDAP server availability within 1 hour, causing user and group synchronization to fail between LDAP and the firewall.
    Clear Condition
    Incident clears when no LDAP group mapping errors occur for 24 hours, indicating successful synchronization of users and groups between LDAP and the firewall.

    Incident: NAT Allocation Failure

    Incident Code
    INC_NGFW_NAT_ALLOCATION_FAILED
    Category
    Device
    Subcategory
    System Resources
    Description
    This alert triggers when at least one NAT rule is unable to allocate enough resources for translation.
    Raise Condition
    This incident is raised if the rate of change for the 'flow_fpp_nat_dipp_max_retries' counter OR the 'flow_policy_nat' counter exceeds the configured threshold persistently for a duration of 1 hour.
    Clear Condition
    This incident will be cleared only if the rate of change for the triggering counter remains continuously below the defined threshold for a full 4-hour period.

    Incident: NAT Pool Usage

    Incident Code
    INC_NGFW_NAT_POOL_USAGE
    Category
    Device
    Subcategory
    System Resources
    Description
    This alert triggers when one or more NAT rules have high resource usage.
    Raise Condition
    When any NAT Policy pool usage exceeds 85% of its max limit for at least 1 hour and is recurring at least 2 times in the past ( so in total 3 such occurrences )
    Clear Condition
    When any NAT Policy pool usage is less than 85% of its max limit for at least 4 hour

    Incident: NGFW received BGP Routes beyond the configured max Prefixes

    Incident Code
    INC_NGFW_BGP_MAX_PREFIXES_RECEIVED
    Category
    Network and Traffic
    Subcategory
    Routing
    Description
    This alert is triggered when this NGFW's BGP peer advertises more routes than the NGFW can handle based on its configured max prefixes capacity.
    Raise Condition
    Incident raises when the BGP peer advertises more routes than the firewall can handle based on its configured maximum prefix limit within 1 hour.
    Clear Condition
    Incident clears when the BGP peer stops sending excessive routes and stays within the firewall's configured limit for 1 hour.

    Incident: NPC Card - FE100 Failure

    Incident Code
    INC_NGFW_NPC_CARD_FE_100_FAILED
    Category
    Device
    Subcategory
    Hardware
    Description
    Network Processing Cards (NPCs) provide network connectivity and are essential for network traffic processing. An NPC card has experienced an issue with its FE100 component, leading to its failure.
    Raise Condition
    Detected FE100 failure on NPC card
    Clear Condition
    FE100 failure cleared on NPC card

    Incident: Non-default Logging level

    Incident Code
    INC_NGFW_NON_DEFAULT_LOGGING
    Category
    Network Services
    Subcategory
    Logging
    Description
    This alert is triggered when the logging level of a service is not set to its default configuration. This alert ensures that services consistently maintain their designated logging settings.
    Raise Condition
    The logging level is set to a non-default value.
    Clear Condition
    The logging level is set to a default value.

    Incident: Out Of Sync HA Peers - Configuration

    Incident Code
    INC_NGFW_OUT_OF_SYNC_PEERS_CONFIGURATION
    Category
    Device
    Subcategory
    High Availability
    Description
    This incident indicates a configuration discrepancy between High Availability (HA) peers, primarily due to the "Enable Config Sync" option being disabled in the High Availability General settings.
    Raise Condition
    Running config file between the HA pair of devices is not synchronized for 2 hours
    Clear Condition
    If the running configuration is in sync with the peer device for at least 4 hours.

    Incident: Out of Sync Peers - Dynamic Content

    Incident Code
    INC_NGFW_OUT_OF_SYNC_PEERS_DYNAMIC_CONTENT
    Category
    Device
    Subcategory
    High Availability
    Description
    This incident triggers when dynamic content, such as Applications, Threats, or Antivirus versions, is not synchronized between firewalls in a high-availability (HA) pair.
    Raise Condition
    If Dynamic Content ( Anti virus, Apps and Threat) is Out of Sync between HA Peers for 1 week.
    Clear Condition
    If the Dynamic content between the HA peers are not outdated for 1 week.

    Incident: Out of Sync Peers - Sessions

    Incident Code
    INC_NGFW_OUT_OF_SYNC_SESSIONS
    Category
    Device
    Subcategory
    High Availability
    Description
    Sessions are not matching or up to date between the High availability Peers.
    Raise Condition
    When HA2 data link interface (dedicated HA communication interface) is not configured
    Clear Condition
    When HA2 data link interface (dedicated HA communication interface) is configured

    Incident: Out of Sync Peers - Software

    Incident Code
    INC_NGFW_OUT_OF_SYNC_PEERS_SW
    Category
    Device
    Subcategory
    High Availability
    Description
    The PAN-OS software versions on the high availability peers do not match.
    Raise Condition
    When the PAN-OS software versions on the High Availability (HA) peers do not match.
    Clear Condition
    When the PAN-OS software versions on the High Availability (HA) peers match.

    Incident: Outdated Dynamic Content - Antivirus

    Incident Code
    INC_NGFW_OUTDATED_DYNAMIC_CONTENT_ANTIVIRUS
    Category
    Device
    Subcategory
    Management
    Description
    The dynamic content installed on your device is outdated compared to the latest version available on the update server. This means your device isn't leveraging the most current security intelligence.
    Raise Condition
    This incident is raised when the system fails to update its Antivirus dynamic content. The failure can occur during either the download process from the update server or during the subsequent installation of the downloaded content. The device may not have the latest threat intelligence protections provided by the Antivirus package.
    Clear Condition
    This incident will clear automatically once the Antivirus dynamic content has been successfully downloaded and installed on the system. When the device confirms a successful update, the incident will be resolved, indicating that threat intelligence is current.

    Incident: Outdated Dynamic Content - Apps and Threats

    Incident Code
    INC_NGFW_OUTDATED_DYNAMIC_CONTENT_APPSANDTHREATS
    Category
    Device
    Subcategory
    Management
    Description
    The dynamic content installed on your device is outdated compared to the latest version available on the update server. This means your device isn't leveraging the most current security intelligence.
    Raise Condition
    This incident is raised when the system fails to update its Apps and Threat dynamic content. The failure can occur during either the download process from the update server or during the subsequent installation of the downloaded content. The device may not have the latest threat intelligence protections provided by the Apps and Threat content package.
    Clear Condition
    This incident will clear automatically once the Apps and Threat dynamic content has been successfully downloaded and installed on the system. When the device confirms a successful update, the incident will be resolved, indicating that threat intelligence is current.

    Incident: Outdated Dynamic Content - Wildfire

    Incident Code
    INC_NGFW_OUTDATED_DYNAMIC_CONTENT_WILDFIRE
    Category
    Device
    Subcategory
    Management
    Description
    The dynamic content installed on your device is outdated compared to the latest version available on the update server. This means your device isn't leveraging the most current security intelligence.
    Raise Condition
    This incident is raised when the system fails to update its WildFire dynamic content. The failure can occur during either the download process from the update server or during the subsequent installation of the downloaded content. The device may not have the latest threat intelligence protections provided by the WildFire package.
    Clear Condition
    This incident will clear automatically once the WildFire dynamic content has been successfully downloaded and installed on the system. When the device confirms a successful update, the incident will be resolved, indicating that threat intelligence is current.

    Incident: PA-5450 NC card - FE100 Failure

    Incident Code
    INC_NGFW_PA5450_NC_CARD_FE100_FAILURE
    Category
    Device
    Subcategory
    Hardware
    Description
    Networking Cards (NCs) provide network connectivity and are essential for network traffic processing. An NC card has experienced an issue with its FE100 component, which triggers its internal link fault, causing path monitoring failure on the Dataplane Processing Card (DPC).
    Raise Condition
    This incident is raised if the log message “FE100 NIF re-init failed, ret 0xb” is detected at least once within a one-hour window.
    Clear Condition
    This incident is cleared when the log message “FE100 NIF re-init failed, ret 0xb” is no longer detected.

    Incident: PAN-OS End-of-Life

    Incident Code
    INC_NGFW_END_OF_LIFE_SOFTWARE
    Category
    Device
    Subcategory
    EOL/EOS
    Description
    Your current version of PAN-OS is no longer supported.
    Raise Condition
    When End of life for software is less than 90 days
    Clear Condition
    When End of life for software is more than 90 days

    Incident: PAN-OS Known Vulnerability

    Incident Code
    INC_NGFW_PANOS_KNOWN_VULNERABILITY_EXCEEDED_VALUE
    Category
    Device
    Subcategory
    Vulnerability
    Description
    Your current version of PAN-OS has known vulnerabilities.
    Raise Condition
    When the feature is affected by that vulnerability, and it is also enabled on the device.
    Clear Condition
    When the enabled feature is not affected by the vulnerability.

    Incident: PAN-OS integrated User-ID Agent Monitored Server Disconnected

    Incident Code
    INC_NGFW_USER_ID_AGENT_DISCONNECTION
    Category
    Network Services
    Subcategory
    User-ID
    Description
    This alert is triggered when the server, monitored by the PAN-OS integrated User-ID Agent (Agentless User-ID), loses connection with the firewall. This monitored server is a critical component for mapping user identities to network activities.
    Raise Condition
    When the User ID agent is disconnected
    Clear Condition
    When all User ID agents are connected

    Incident: Path Monitor Failure - Card

    Incident Code
    INC_NGFW_PATH_MON_FAIL_CARD
    Category
    Device
    Subcategory
    Hardware
    Description
    A path monitoring failure has been detected on a card located within the firewall's slots.
    Raise Condition
    Path monitor failure detected
    Clear Condition
    Path monitor failure cleared

    Incident: Port Failure

    Incident Code
    INC_NGFW_PORT_FAILURE
    Category
    Device
    Subcategory
    Hardware
    Description
    A failure related to the management physical port or one of the high-availability physical ports has been detected.
    Raise Condition
    Error detected in management physical port or high-availability physical ports
    Clear Condition
    Error cleared in corresponding management physical port or high-availability physical ports

    Incident: Reduced Log Forwarding Detected

    Incident Code
    INC_NGFW_REDUCED_LOG_FORWARDING
    Category
    Network Services
    Subcategory
    Logging
    Description
    This alert triggers when the NGFW's log-receiver fills up, causing it to drop logs. This issue can stem from several factors, including: • A network connectivity problem to an external logging service (like a Log collector, syslog, SNMP, email server). • An issue with the external logging service itself, such as it being offline or unable to process incoming logs. • A resource constraint on the NGFW or the external logging service, such as high CPU or memory utilization. When this occurs, a significant portion of the NGFW's log data isn't forwarded to its intended destination.
    Raise Condition
    When logs fail to get forwarded to its respective destination for 1 hours
    Clear Condition
    When the logs are getting forwarded and there is no delay or loss in log forwarding for at least 4 hours
    Probable Root Cause Incident
    "INC_NGFW_DISK_HINT_OVERFLOW_LOG_FWD_FAIL",
    "INC_NGFW_LOG_FORWARDING_DISABLED_DUE_TO_SNMP_SERVER_UNRESOLVED_HOSTNAME",
    "INC_NGFW_LOG_FWD_MISSING_COLLECTOR_PREF",
    "INC_NGFW_LOG_FWD_DELAY"

    Incident: Redundant Power Supply Failure

    Incident Code
    INC_NGFW_POWER_SUPPLY_FAILED
    Category
    Device
    Subcategory
    Hardware
    Description
    This incident triggers when a firewall has insufficient power supplies installed to meet redundancy requirements.
    Raise Condition
    Redundancy requirements are not met because the firewall has fewer operational power supplies than required for full power redundancy.
    Clear Condition
    Power redundancy requirements are fully met, with the required number of operational power supplies installed and functioning.

    Incident: Terminal Server agent Self-signed Certificate Expiration

    Incident Code
    INC_NGFW_TS_AGENT_CERT_EXPIRATION
    Category
    Network Services
    Subcategory
    User-ID
    Description
    This alert detects the expiration of the Terminal Server agent self-signed certificate on November 18, 2024.
    Raise Condition
    This incident is triggered if the firewall is running a PAN-OS version affected by the Terminal Server agent self-signed certificate expiration and has a configuration impacted by it.
    Clear Condition
    This incident is cleared when the firewall is no longer running a PAN-OS version affected by the Terminal Server agent self-signed certificate expiration, or the configuration is no longer impacted.

    Incident: Thermal Issues

    Incident Code
    INC_NGFW_ENV_THERMAL_ISSUE
    Category
    Device
    Subcategory
    Hardware
    Description
    This incident triggers when the device temperature exceeds the defined operational range.
    Raise Condition
    When the Temperature exceeds the optimal operating range for any component and stays above the range for at least 2 hours
    Clear Condition
    When the Temperature comes back to the optimal operating range and stays there for at least 2 hours for any components

    Incident: Transceiver or SFP Port - Failed to Write Value

    Incident Code
    INC_NGFW_SFP_PORT_WRITE_FAIL
    Category
    Device
    Subcategory
    Hardware
    Description
    This alert triggers when the error "Failed to write value from byte 0 to offset" is found in the device, usually indicating a faulty transceiver, cable, or SFP port in the device.
    Raise Condition
    This incident is raised if the error "Failed to write value from byte 0 to offset" is found in the device.
    Clear Condition
    This incident is cleared if the error "Failed to write value from byte 0 to offset" is no longer occurring in the device.

    Incident: URLs or IPs with EDLs Approaching Max Limits

    Incident Code
    INC_NGFW_CONFIG_EDL_USAGE
    Category
    Device
    Subcategory
    System Resources
    Description
    The number of URLs, IPs, or Domains within the configured EDL(s) used in policy on this firewall is approaching the maximum capacity that the firewall can support.
    Raise Condition
    When URL or IP EDL usages exceed 95% of the capacity for that firewall model and remain above 95% for five days within a week.
    Clear Condition
    When URL or IP EDL usages fall below 95% of the capacity for that firewall model and stay below 95% for two weeks.

    Incident: Unofficial URL for Application Database

    Incident Code
    INC_NGFW_UNOFFICIAL_URL_FOR_APP_DB
    Category
    Device
    Subcategory
    Management
    Description
    This alert triggers when the firewall's dynamic content update for the Application Database uses an unofficial URL to download the update. Administrators may use QA servers for troubleshooting dynamic update downloads, sometimes without realizing these are test servers. After successful testing, they may forget to reset the firewall to the correct URL for downloading updates.
    Raise Condition
    This incident is raised if the firewall's dynamic content update for the Application Database uses an unofficial URL to download the update.
    Clear Condition
    This incident is cleared if the firewall's dynamic content update for the Application Database uses an official URL to download the update.

    Incident: Unofficial URL for Cloud Services

    Incident Code
    INC_NGFW_UNOFFICIAL_URL_FOR_CLOUD_SERVICES
    Category
    Device
    Subcategory
    Management
    Description
    This alert triggers when the firewall's dynamic content update for the Cloud Services uses an unofficial URL to download the update. Administrators may use QA servers for troubleshooting dynamic update downloads, sometimes without realizing these are test servers. After successful testing, they may forget to reset the firewall to the correct URL for downloading updates.
    Raise Condition
    This incident is raised if the firewall's dynamic content update for the Cloud Services uses an unofficial URL to download the update
    Clear Condition
    This incident is cleared if the firewall's dynamic content update for the Cloud Services uses an official URL to download the update

    Incident: Unofficial URL for PAN-DB URL Filtering | Advanced URL Filtering

    Incident Code
    INC_NGFW_UNOFFICIAL_URL_FOR_PAN_DB
    Category
    Device
    Subcategory
    Management
    Description
    This alert triggers when the firewall's dynamic content update for the PAN-DB URL Filtering | Advanced URL Filtering uses an unofficial URL to download the update. Administrators may use QA servers for troubleshooting dynamic update downloads, sometimes without realizing these are test servers. After successful testing, they may forget to reset the firewall to the correct URL for downloading updates.
    Raise Condition
    This incident is raised if the firewall's dynamic content update for the PAN-DB URL Filtering | Advance URL Filtering uses an unofficial URL to download the update.
    Clear Condition
    This incident is cleared if the firewall's dynamic content update for the PAN-DB URL Filtering | Advance URL Filtering uses an official URL to download the update.

    Incident: Unofficial URL for WildFire | Advanced WildFire

    Incident Code
    INC_NGFW_UNOFFICIAL_URL_FOR_WILDFIRE
    Category
    Device
    Subcategory
    Management
    Description
    This alert triggers when the firewall's dynamic content update for WildFire | Advanced WildFire uses an unofficial URL to download the update. Administrators may use QA servers for troubleshooting dynamic update downloads, sometimes without realizing these are test servers. After successful testing, they may forget to reset the firewall to the correct URL for downloading updates.
    Raise Condition
    This incident is raised if the firewall's dynamic content update for WildFire | Advanced WildFire uses an unofficial URL to download the update.
    Clear Condition
    This incident is cleared if the firewall's dynamic content update for WildFire | Advanced WildFire uses an official URL to download the update.

    Incident: User Group Usage in Policies exceeding the supported limit

    Incident Code
    INC_NGFW_USER_GROUP_POLICY_LIMIT_EXCEEDED
    Category
    Network Services
    Subcategory
    User-ID
    Description
    This alert indicates the number of users or user groups configured in the firewall policies has exceeded the supported limit.
    Raise Condition
    This incident is raised if a log message indicating that the users or user groups configured in the firewall policies have exceeded the supported limit is detected at least once within a one-hour window.
    Clear Condition
    This incident is cleared if a log message indicating that the users or user groups configured in the firewall policies have exceeded the supported limit is no longer detected for at least one hour.

    Incident: User-ID agent Self-signed Certificate Expiration

    Incident Code
    INC_NGFW_UID_AGENT_CERT_EXPIRATION
    Category
    Network Services
    Subcategory
    User-ID
    Description
    This alert detects the expiration of the User-ID agent self-signed certificate on November 18, 2024. The alert detects if a PAN-OS device has a User-ID policy configured, meets the PAN-OS version requirements per Table 1 of the advisory, and uses a self-signed certificate. It does not apply if custom certificates are in use or User-ID mappings are provided only by an NGFW that serves as a User-ID agent or from GlobalProtect agents.
    Raise Condition
    This incident is triggered if the firewall is running a PAN-OS version affected by the User-ID agent self-signed certificate expiration and has a configuration impacted by it.
    Clear Condition
    This incident is cleared when the firewall is no longer running a PAN-OS version affected by the User-ID agent self-signed certificate expiration, or the configuration is no longer impacted.

    © 2026 Palo Alto Networks, Inc. All rights reserved.