topic Re: SYSTEM ALERT : medium : MLAV: Unknown error in General Topics

SYSTEM ALERT : medium : MLAV: Unknown error

KirkH — Fri, 26 Jul 2024 08:33:07 GMT

Repeatedly receiving the above alert on 4 separate PA firewalls throughout the evening, can't find much information online relating to it. Has anyone else received this message before? If so, what steps should I take to troubleshoot and resolve the message. currently running versions 10.2.6-h3 and 11.0.3-h10. Thanks

Re: SYSTEM ALERT : medium : MLAV: Unknown error

zhangfw — Fri, 26 Jul 2024 10:55:02 GMT

问同样的问题，我也发现了这个问题，今天突然出现了

Re: SYSTEM ALERT : medium : MLAV: Unknown error

Dom17nj — Fri, 26 Jul 2024 12:12:43 GMT

Same here, comes every 5 minutes started yesterday. 10.1.13-h1. I have opened a case..

Re: SYSTEM ALERT : medium : MLAV: Unknown error

gyoniku — Fri, 26 Jul 2024 12:17:51 GMT

The same event is occurring in 10.2.7.

It was resolved by the command "debug software restart process device-server" on my PA-220.

However, the cause is unknown and is not an official solution.

Re: SYSTEM ALERT : medium : MLAV: Unknown error

JosephGajda — Fri, 26 Jul 2024 12:39:20 GMT

10.2.9-h1 same.

Re: SYSTEM ALERT : medium : MLAV: Unknown error

B.Toader — Fri, 26 Jul 2024 12:49:18 GMT

Hello,

After the command receive from Support not works, the messages appear after 30 -40 minutes again .

Please perform show mlav cloud-status if the services it's still busy that is the reason why not send messages

Thank you

Re: SYSTEM ALERT : medium : MLAV: Unknown error

DanielWaldmeier — Fri, 26 Jul 2024 13:07:46 GMT

Same here, comes every 5 minutes started yesterday. 10.2.10.

Re: SYSTEM ALERT : medium : MLAV: Unknown error

Charles-SFG — Fri, 26 Jul 2024 13:23:38 GMT

Same here.

Re: SYSTEM ALERT : medium : MLAV: Unknown error

Charles-SFG — Fri, 26 Jul 2024 13:26:51 GMT

We also see it on the passive firewall in active/passive HA. I wouldn't expect a passive firewall to be sending anything the the cloud for analysis.

Re: SYSTEM ALERT : medium : MLAV: Unknown error

B.Toader — Fri, 26 Jul 2024 13:29:29 GMT

https://live.paloaltonetworks.com/t5/general-topics/system-alert-medium-mlav-unknown-error/m-p/593128

Re: SYSTEM ALERT : medium : MLAV: Unknown error

gyoniku — Fri, 26 Jul 2024 13:49:27 GMT

I got this in CSP.

“MLAV: Unknown error.” messages seen in the system logs every 5 minutes

There is no decrease in security coverage with this error.
This issue here is not impacting traffic and the firewall can maintain the same level of security coverage using the most recent content update.
Our engineering team is working on fixing the issue with the error messages.

Re: SYSTEM ALERT : medium : MLAV: Unknown error

MP18 — Sat, 27 Jul 2024 21:55:59 GMT

I fixed the issue by running command

debug software restart process device-server on both Active and passive PA.

Version 10.2.8-h3

Issue Fixed

Regards

Re: SYSTEM ALERT : medium : MLAV: Unknown error

SunilGugilapu — Mon, 29 Jul 2024 12:23:06 GMT

Did you get any update from support ?

Re: SYSTEM ALERT : medium : MLAV: Unknown error

KirkH — Mon, 29 Jul 2024 12:33:24 GMT

solution provided from support:

Kindly restart the device server using the command mentioned below and let me know if it is helpful
>> debug software restart process device-server

Note:
In most cases, restarting the device server or management server will not cause any impact on traffic passing through the data plane. These two processes are major parts of the device's management plane processing.

Re: SYSTEM ALERT : medium : MLAV: Unknown error

DanielWaldmeier — Mon, 29 Jul 2024 15:54:50 GMT

Issue seem to be fixed without doing anything.

Most probably the AV dynamic update of 2024-07-26 fixed it again.

Re: SYSTEM ALERT : medium : MLAV: Unknown error

B.Toader — Tue, 30 Jul 2024 06:27:51 GMT

The response from tech team from Palo Alto how they fix the problem

I want to inform you on the issue regarding the system log alert. We have received information from the engineering team that the alert was appearing because a file was missing in the Palo Alto cloud. This file has now been successfully pushed, and as a result, the alerts have stopped.

Thank you for choosing Palo Alto Networks!