topic Re: wildfire-upload-fail in General Topics

wildfire-upload-fail

lewis — Thu, 06 Nov 2014 12:03:34 GMT

Looking to find out more about wildfire-upload-fail. Has anyone had any of these and if so were you able to determine the root cause?

Re: wildfire-upload-fail

HULK — Thu, 06 Nov 2014 13:11:07 GMT

Hello Lewis,

Could you please check this article : What Does Wildfire-Upload-Fail Mean?

Also, verify the connectivity from your PAN FW:

WildFire CLI commands

The following commands provide the details of the best server selected. To test the Connectivity, follow the steps below:

> test wildfire registration

This test may take a few minutes to finish. Do you want to continue? (y or n)

Test wildfire

wildfire registration: successful

download server list: successful

select the best server: va-s1.wildfire.paloaltonetworks.com

Initial registration can only be done on the active unit in an Active/Passive cluster.

Note: Do not use PING to test connectivity to the server. Ping requests are disabled on the WildFire server. Best practice to test connectivity is to Telnet to the server on port 443.

To verify, if any files have been forwarded to the server, use the following command:

> show wildfire status

Connection info:

Wildfire cloud: default cloud

Status: Idle

Best server: va-s1.wildfire.paloaltonetworks.com

Device registered: yes

Service route IP address: 10.30.24.52

Signature verification: enable

Server selection: enable

Through a proxy: no

Forwarding info:

file size limit (MB): 2

file idle time out (second): 90

total file forwarded: 0

forwarding rate (per minute): 0

concurrent files: 0

The total file forwarded counter will provide the number of files being forwarded to the server.

Reference DOC: How to Configure WildFire

Thanks

Re: wildfire-upload-fail

ssharma — Thu, 06 Nov 2014 13:13:00 GMT

Hi Lewis,

Please find following document :

What Does Wildfire-Upload-Fail Mean?

It says :

"The cause of this message is typically from network issues, such as, incorrect DNS configuration, connection timeouts, etc. View the varrcvr.log to help find the error logs with the specific cause of the message. For example, a search for the string, “pan_fbd_cloud_upload error" may yield results (as in the following error) that provide the cause:

Error: pan_fbd_fwd_msg_process(pan_fbd_fwd.c:1311): pan_fbd_cloud_upload error 26, Failed to open/read local data from file/application"

Hope this helps. Thank you.

Re: wildfire-upload-fail

hshah — Thu, 06 Nov 2014 14:08:47 GMT

Hi Lewis,

Provide us output for "less mp-log varrcvr.log", output will be a huge file. Make sure you are logging the session in txt file.

Provide us that txt file, based on error message we should be able to determine root cause.

Regards,

Hardik shah

Re: wildfire-upload-fail

lewis — Thu, 06 Nov 2014 14:22:28 GMT

Is there any impact on production by running this command?

Re: wildfire-upload-fail

HULK — Thu, 06 Nov 2014 14:23:46 GMT

no, it should not impact your production network.

Thanks

Re: wildfire-upload-fail

hshah — Thu, 06 Nov 2014 14:27:02 GMT

Hi Lewis,

Its just a show command in Palo Alto World, you are good to go.

Regards,

Hardik Shah

Re: wildfire-upload-fail

lewis — Thu, 06 Nov 2014 15:08:15 GMT

does this command typically take a while to run? been sitting at 0%

Re: wildfire-upload-fail

ssharma — Thu, 06 Nov 2014 15:24:43 GMT

That probably means there are no logs available as of yet. You might have to enable debug for vardata receiver. "debug vardata-receiver on debug" on done you can change it back to "debug vardata-receiver on info".

Let it for a while, and check "less mp-log varrcvr.log"

You should see some logs. You can either user Space-Bar to go down the logs or use "shift + g" to go at the bottom of the logs. Hope this helps. Thank you.

Re: wildfire-upload-fail

hshah — Thu, 06 Nov 2014 18:45:52 GMT

Hi Lewis,

If firewall is configured for wildfire than varrcver should have some logs. No logs is not good. I think there might be something wrong with the varrcvr process.

Can you please provide me output for "show system resource"

Regards,

Hardik Shah

Re: wildfire-upload-fail

jperry1 — Thu, 06 Nov 2014 20:33:25 GMT

lewis

If you are still having the following issues try running the following command

debug wildfire reset all

Once you have ran this command try to upload using the fake test file from

How to Test WildFire with a Fake Malicious File

Re: wildfire-upload-fail

lewis — Fri, 07 Nov 2014 11:28:42 GMT

ssharma hshah I was able to get an output of the varrcver file while on a call with support. However we were unable to resolve the issue on that call. But now it appears the issue no longer exist as wildfire traffic is working as expected. Not sure what the root cause was but I will be monitoring.

jperry1 Are there any performance issues I should be aware of before running this debug command?

Re: wildfire-upload-fail

jperry1 — Fri, 07 Nov 2014 16:19:07 GMT

lewis

No impact to performance by running this command.

Re: wildfire-upload-fail

lewis — Wed, 12 Nov 2014 17:37:38 GMT

The root cause ended up being a backend issue with Wildfire as a server was running out of space and caused the fails.