topic Re: PA-3020 - Error: Threat database handler failed - Commit failed in General Topics

PA-3020 - Error: Threat database handler failed - Commit failed

dmetcalfe — Fri, 01 Oct 2021 08:39:16 GMT

Hi,

Our Palo Alto has been rock solid for years, but last friday we realized we are unable to commit changes.

We're pretty sure it started happening with the release of content package version 8462-6955.

We hoped this was a one-off and the next upgrade would solve the issue. But all further upgrades have failed & we still can't commit changes.

Has anyone else ran into this problem recently? It's looks like this is similar, but those links only mention it affecting older versions of the firewall software.

Thanks

Re: PA-3020 - Error: Threat database handler failed - Commit failed

SutareMayur — Sat, 02 Oct 2021 12:54:41 GMT

Hi @dmetcalfe ,

Such kind of issues are observed due to corrupt content update or database. Kindly refer below articles to follow steps to resolve such issues.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRSCA0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTBCA0

Hope it helps!

Re: PA-3020 - Error: Threat database handler failed - Commit failed

S.Cantwell — Sat, 02 Oct 2021 16:02:15 GMT

@SutareMayur Howdy.. and Welcome to the CyberElite Group!

I too, am CyberElite, and the articles you listed, I have tried, and found they are not success (for my customer). Everyone's experience may be different. A support case I had was that Auto Commit was failing, and when we tried to the Commit Force, the Threat Handler error came up. We downloaded the most current version (because, yesterdays was bad??) and tried the commit force again, and still.

We have a TAC escalation case for this.

In addition, I will PANW TAC would update these articles. My customer has 10.x and the articles are for 6.x and 7.x..

Definitely, some improvement is needed.

Re: PA-3020 - Error: Threat database handler failed - Commit failed

BPry — Sun, 03 Oct 2021 05:16:01 GMT

@dmetcalfe,

The workaround that @SutareMayur mentioned are steps that you should take as they can help clear this issue. If it doesn't work contact TAC and they'll have to use support credentials to actually access the filesystem and clear the cache so that you can actually load an updated release. The KB articles are older, but the steps haven't changed in subsequent releases.

I would personally recommend that you set a threshold of at least 12 hours on your dynamic update schedule for application and threats. This ensures that you aren't loading new content updates unless they've actually been released for a bit which can help prevent bad content updates if you haven't already.

Lastly, update your software! Your PA-3020 is running 7.1.5 which went end of life on June 30th 2020. Unless you're running 8.1 you aren't getting new signatures app-id updates, and your version of 7.1 isn't even the last maintenance release within the 7.1 code branch. That's a severely outdated box.

Re: PA-3020 - Error: Threat database handler failed - Commit failed

SutareMayur — Mon, 04 Oct 2021 12:51:52 GMT

Hi @S.Cantwell ,

Thanks for sharing your experience related to this. Yeah the everyone’s experience with this solution may be different. Actually the same solution had worked for me in the past on one of our environment.

And also totally agreed with @BPry If it doesn’t work, then raise a case with TAC.