topic Re: Failed to add correlation object 601x in General Topics

Failed to add correlation object 601x

scottsander — Wed, 16 Nov 2016 14:18:25 GMT

This morning, I've received the following alerts from both of our PA-3050 firewalls:

Failed to add correlation object 6011

Failed to add correlation object 6012

Failed to add correlation object 6013

Failed to add correlation object 6014

Failed to add correlation object 6015

Failed to add correlation object 6016

Failed to add correlation object 6017

It seems to have occurred after the Apps and Threats update file panupv2-all-contents-635-3681.tgz installation.

Is anyone else seeing this?

Re: Failed to add correlation object 601x

kiwi — Wed, 16 Nov 2016 14:44:30 GMT

Hi @scottsander,

In content 635, Palo Alto Networks released seven new data correlation objects. Data Correlation Objects require a minimum PAN-OS version 8.0.0. (will be released soon). When content 635 is installed on PAN-OS version 7.1 or older you will see system alarms indicating that these objects could not be installed. This is expected behavior.

Cheers !

-Kim.

Re: Failed to add correlation object 601x

scottsander — Wed, 16 Nov 2016 14:51:29 GMT

Should we expect to see alerts like these every time an apps and threats content package is installed until we move to PAN-OS 8.0.x?

Re: Failed to add correlation object 601x

Brandon_Wertz — Wed, 16 Nov 2016 14:52:37 GMT

So this begs the question, can't there be a better way to deploy content packages which inherently won't work on certain platforms?

Re: Failed to add correlation object 601x

ChrisMurr — Wed, 16 Nov 2016 16:20:35 GMT

Release notes listing the objects in question:

https://downloads.paloaltonetworks.com/content/content-635-3681.html?__gda__=1479354758_2196898ad325596b44839f4b4e26f728

Re: Failed to add correlation object 601x

BPry — Wed, 16 Nov 2016 16:46:26 GMT

I'm with @Brandon_Wertz. There has to be a better way to actually role these out if it isn't going to ever work with our software version; getting high level system alerts in the middle of the night isn't exactly 'fun' only to look at the release notes and relize that they are objects that will never be installed on the version we are running, for an OS that isn't even public yet.

Does this mean that we will see these alerts until the release of 8.0 and our eventual deployment to that platform, because if so I need to figure out a way to modify how these alert so it doesn't come across as a 'high' level system alert. Not a fan of waking up to discover a non-issue at 1 in the morning.

Re: Failed to add correlation object 601x

Brandon_Wertz — Wed, 16 Nov 2016 16:48:44 GMT

The release notes don't even mention errors being presented in system logs. Just says "works on PAN-OS 8.0 minimum."