dynamic updates are downloaded but not installed

[minow]

hey

we have a cluster that is configured to download and install updaetd but we can see that it is only downloading them and doen not update,

where can i find related logs on the device? (PAN-OS 5)

[panos]

as I know you can see them

less mp-log ms.log

also for the errors

Updater Error Codes

for installation I am not sure.maybe you'll see there also.

[pulukas]

On the monitor tab -- Logs -- System

This will show logging for the updates

[panos]

did you check job details ?

show jobs all | match Content

show jobs id ....

[Phoenix]

Hello Minow,

Can you pls verify as shown below if it is set to "Download and Install" and not just download.

Even after this if it is just downloading. We can look output in the "show jobs all"

We should see for example 3 jobs in this order 1> Download 2> Content 3> Antivirus

If not we can find details in the ms.log and devsrv.log for related details.

Hope this helps

Thanks

[pulukas]

Also make sure the multiple schedules are at different times so there are no conflicts.

[HULK]

Hello, Minow,

Do you have independent internet connectivity through both firewall's ( both HA node) management interface...? If so, then I would recommend to use download and install time slightly different on both nodes while "sync To Peer" is enabled.

You can verify the same information under Monitor >> System logs and CLI command mentioned below

PAN-FW> less mp-log paninstaller_content.log

PAN-FW> less mp-log ms.log

Thanks

[minow]

hey

only the active machine has internet through a L3 interface,

how should the dynamic update page should look like?

should i configure download and install on both members? because i didnt see this is a synced configuration.

didnt find any interesting logs

thanks

[panos]

by default firewall will use management interface for updates.

you can change this from Services tab(look if it is changed)

also read this for HA

https://live.paloaltonetworks.com/docs/DOC-2038

[HULK]

Hello Minow,

You should enable sync-with peer option on the active firewall in order to push the downloaded database to the passive FW.

Which model of PAN FW you are having and what is the running PAN OS version..?

Could you please share CLI output FW>show system info  

Thanks

[minow]

hey

we just configured the two device to download and install the configuration and push to the other member on different times of the day, and now it work smoothly,

I think PA should do or know how to handle it by it own, since it is a cluster and each device should know what the other one is doing,

[pulukas]

Minow,

On a cluster you should configure the updates on your primary member then choose the option to sync those updates to the secondary.  This will keep both cluster members in sync smoothly and only require one set of downloads.

[minow]

yes but if the cluster had fail-over... why shouldn't this process be "wise" ??

i think there are a lot of tasks regarding cluster operation and a lot about panorama that could have been done better

and need some improvement.

lets say for example the update thing or when panorama should manage HA in active passive... so first you have to choose in the PA device to use the MGMT interface to register to panorama, because panorama cant push policy for example to the external interface.... amm actually it can be done, but the commit will commit only on the active device... it is like Panorama doesn't know (or should i say, does not check in the information it already has) that we are talking about a cluster, so i will send a commit to the active device with the SN of both of the device, and the best thing is that even when i push policy using the "external" interface, the active device wont issue a commit to the passive device like it will normally do when you commit locally.

it is like those little thinks that are missing and you say how they didn't think about that