Content / Database Versions Do Not Match

[xcz504d1114]

Every week I recieve these emails while the PAN firewalls do their weekly updates, is there a way to not recieve these e-mails, the time stamps are exactly the same from each device, as they are upgrading at the exact same time. Is there a setting in Panorama that can eliminate these needless messages?

Thanks,

Craig

[rmonvon]

Hi...You can instruct the PAN firewalls not to forward system logs to Panorama, and/or don't forward system logs to email.  The system logs are assigned different severity level and you can select the level(s) you want to send.

Thanks.

[xcz504d1114]

Thanks for the response. The e-mail notifications that are being sent are categorized as "High", obviously I would want to know of severity levels of High and Critical, or am I missing a way to filter out certain messages, as opposed to just severity? I pasted an example of one of the e-mails I recieve during the weekly updates, so that I am accurately describing  the situation.

I recieve one of these emails for each firewall, and each content type (application, url, threat prevention) during weekly updates.

domain: 1
receive_time: 2012/03/14 01:08:18
serial: XXXXXXXXXXXXXX

seqno: 0
actionflags: 0x0
type: SYSTEM
subtype: ha
config_ver: 0
time_generated: 2012/03/14 01:08:18
vsys:
eventid: peer-version-match
object:
fmt: 0
id: 0
module: general
severity: high
opaque: HA Group 1: Application Content version does not match

Thanks again,

Craig

[rmonvon · Accepted solution]

We can filter on the log messages(descriptions) while viewing the logs but not for forwarding.  We can only filter on log severity level and forward/not forward by severity.

You would have to filter externally via a SEIM tool or use rule wizard (rules and alerts) in Outlook to delete those unwanted events.  Thanks.

[xcz504d1114]

Thank you very much! I appreciate your response!

[xcz504d1114]

One more question if you don't mind! Is this normal behavior? Should the devices be reporting they are out of sync every time they update content?

[rmonvon]

Do you have both HA devices setup to perform the content update on their own or just one performing the update and sync the content to its HA peer?

[xcz504d1114]

They were both pulling it down, I set it up for 1 to pull down and sync to the other a few minutes ago, I assume that will eliminate all but the URL update portion (I did not see a sync option for that)?

[rmonvon]

Correct, there is no sync option for the URL filtering updates.

Let's see if changing the update to 1 device & sync will help.  If not, we may be advertising the content version in the HA heartbeats and that may trigger the mismatch.  Thanks.

[xcz504d1114]

So my devices pulled their weekly updates, and I still recieved the out-of-sync e-mails, even with only one of them set to download the updates, and sync it to the secondary. I wonder if updating to a 4.1.X image might contain a fix, I'm currently running 4.0.9.

Thanks,

Craig

[grenzi]

Since it is really annoying to receive this kind of alerts, and since I log into my firewalls at least twice a week to check the state of the dynamic updates, I added this filter on the System log settings for "high severity" events:

(severity eq high) and not (eventid eq peer-version-match)

I'm running 8.0.x and 8.1.x PAN-OS on all my firewalls.