topic Re: dynamic updates are downloaded but not installed in General Topics

dynamic updates are downloaded but not installed

minow — Thu, 09 Jan 2014 12:43:18 GMT

hey

we have a cluster that is configured to download and install updaetd but we can see that it is only downloading them and doen not update,

where can i find related logs on the device? (PAN-OS 5)

Re: dynamic updates are downloaded but not installed

Retired Member — Thu, 09 Jan 2014 12:53:41 GMT

as I know you can see them

less mp-log ms.log

also for the errors

Updater Error Codes

for installation I am not sure.maybe you'll see there also.

Re: dynamic updates are downloaded but not installed

pulukas — Thu, 09 Jan 2014 13:19:42 GMT

On the monitor tab -- Logs -- System

This will show logging for the updates

Re: dynamic updates are downloaded but not installed

Retired Member — Thu, 09 Jan 2014 13:31:02 GMT

did you check job details ?

show jobs all | match Content

show jobs id ....

Re: dynamic updates are downloaded but not installed

Phoenix — Thu, 09 Jan 2014 15:14:37 GMT

Hello Minow,

Can you pls verify as shown below if it is set to "Download and Install" and not just download.

Even after this if it is just downloading. We can look output in the "show jobs all"

We should see for example 3 jobs in this order 1> Download 2> Content 3> Antivirus

If not we can find details in the ms.log and devsrv.log for related details.

Hope this helps

Thanks

Re: dynamic updates are downloaded but not installed

pulukas — Fri, 10 Jan 2014 12:52:46 GMT

Also make sure the multiple schedules are at different times so there are no conflicts.

Re: dynamic updates are downloaded but not installed

HULK — Fri, 10 Jan 2014 15:23:53 GMT

Hello, Minow,

Do you have independent internet connectivity through both firewall's ( both HA node) management interface...? If so, then I would recommend to use download and install time slightly different on both nodes while "sync To Peer" is enabled.

You can verify the same information under Monitor >> System logs and CLI command mentioned below

PAN-FW> less mp-log paninstaller_content.log

PAN-FW> less mp-log ms.log

Thanks

Re: dynamic updates are downloaded but not installed

minow — Sun, 12 Jan 2014 09:11:03 GMT

hey

only the active machine has internet through a L3 interface,

how should the dynamic update page should look like?

should i configure download and install on both members? because i didnt see this is a synced configuration.

didnt find any interesting logs

thanks

Re: dynamic updates are downloaded but not installed

Retired Member — Sun, 12 Jan 2014 10:02:13 GMT

by default firewall will use management interface for updates.

you can change this from Services tab(look if it is changed)

Re: dynamic updates are downloaded but not installed

HULK — Sun, 12 Jan 2014 19:05:52 GMT

Hello Minow,

You should enable sync-with peer option on the active firewall in order to push the downloaded database to the passive FW.

Which model of PAN FW you are having and what is the running PAN OS version..?

Could you please share CLI output FW>show system info

Thanks

Re: dynamic updates are downloaded but not installed

minow — Sat, 08 Feb 2014 07:53:28 GMT

hey

we just configured the two device to download and install the configuration and push to the other member on different times of the day, and now it work smoothly,

I think PA should do or know how to handle it by it own, since it is a cluster and each device should know what the other one is doing,

Re: dynamic updates are downloaded but not installed

pulukas — Sat, 08 Feb 2014 12:05:10 GMT

Minow,

On a cluster you should configure the updates on your primary member then choose the option to sync those updates to the secondary. This will keep both cluster members in sync smoothly and only require one set of downloads.

Re: dynamic updates are downloaded but not installed

minow — Sun, 09 Feb 2014 21:18:20 GMT

yes but if the cluster had fail-over... why shouldn't this process be "wise" ??

i think there are a lot of tasks regarding cluster operation and a lot about panorama that could have been done better

and need some improvement.

lets say for example the update thing or when panorama should manage HA in active passive... so first you have to choose in the PA device to use the MGMT interface to register to panorama, because panorama cant push policy for example to the external interface.... amm actually it can be done, but the commit will commit only on the active device... it is like Panorama doesn't know (or should i say, does not check in the information it already has) that we are talking about a cluster, so i will send a commit to the active device with the SN of both of the device, and the best thing is that even when i push policy using the "external" interface, the active device wont issue a commit to the passive device like it will normally do when you commit locally.

it is like those little thinks that are missing and you say how they didn't think about that