topic Re: Other Administrators are holding device wide commit locks in General Topics

Other Administrators are holding device wide commit locks

Intrafind — Tue, 16 Oct 2018 11:30:54 GMT

Hi Guys,

i have actually the problem that i cant do any commit, there are two pending commits and if i try to commit the following message appearing:

"Error Other Administrators are holding device wide commit locks".

Even when im logged in as the administrator who did the commit the same message appears. The Administratoraccounts are supperusers.

Re: Other Administrators are holding device wide commit locks

gwesson — Tue, 16 Oct 2018 17:11:54 GMT

You can check to see the admins who have a commit lock via the UI or CLI:

> show commit-locks

Commit locks are designed to prevent any other logged in admins (even other superusers) from doing a commit until the lock is released. If you're a superuser, and you see commit locks from the CLI command above, you can clear them with:

> request commit-lock remove

For the GUI version, check this document:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CltACAS

Re: Other Administrators are holding device wide commit locks

OtakarKlier — Wed, 17 Oct 2018 16:12:51 GMT

Hello,

Commit locks are a good way to ensure there is no administrator poisoning. Meaning if one makes a change and antoehr makes a change, they could accidentally break or revert the first admins changes.

Regards,

Re: Other Administrators are holding device wide commit locks

BlackWater — Wed, 30 Apr 2025 16:13:53 GMT

That’s not always the case—it could simply be a generic message that Panorama is displaying. I encountered a similar issue while working with a 5450 Firewall, where I was the only one connected to Panorama. Despite having the template marked as active and using the "force template values" option, I couldn’t push any template configuration to the firewall.

The configuration appeared to be copied to the destination firewall, but I noticed that certain elements—such as the virtual wire, untrust/trust zones, and interfaces 1/1 and 1/2—were already present on the local firewall, even though I hadn’t configured them myself. When I checked the XML file in Panorama, these configurations were not present in the template.

After spending hours trying to resolve the issue—detaching and reattaching the firewall, resetting it, downgrading and upgrading—it turned out the effective solution was to treat the firewall as a completely new device. Here's what worked:

1. Perform a factory reset on the firewall.

2. Reboot the device.

3. Delete the default configurations (zones, interfaces 1/1 and 1/2, virtual wire, and default router).

4. Commit the changes.

5. Attach the firewall to Panorama.

6. Verify that the firewall is connected to Panorama.

7. Push the configuration from Panorama to the firewall, ensuring that “force template values” is selected.

After following these steps, everything worked as expected.