Latest content updates failing?

[darren_g]

Anyone else seeing this one?

On both my firewall installations (2020 HA pair and 3020 standalone), the last two content updates (the failed one 473 and the replacement 474) are failing to complete, according to the job log, vis-a-vis

Yet the relevant content update shows as "installed" in the dynamic updates page.

Is anyone else seeing this? Or am I the only one who compulsively watches the install logs for content updates to make sure they work?

Thanks

[_slv_]

Hi Darren

What PANOS are you using?

I have problems with updates too but I'm on 6.1.0 but my problems are with Antivirus udpates.

>Or am I the only one who compulsively watches the install logs for content updates to make sure they work?

I'm doing the same ... but I'm thinking that is it usefull ... I have case opened for few weeks, but support in my opinion do NOTHING in this case (even do not read my emails carefully)

This case is a second one with same problem (missed updates and UNKNOW build of updates).

Recomendation for You is to remove any updates files from device and download it again (its possible to do by CLI only)

Regards

SLawek

[darren_g · Accepted solution]

> What PANOS are you using?

I have one set (2020 HA cluster) on version 5 (5.0.11) and another (3020 standalone) on version 6 (6.0.2). I don't get upgrade windows very often, so I'm a bit behind - and I don't want to stress the already overworked 2020's by upping them to version 6 with its continued additional feature load on a management plane which can't keep up.

> I'm doing the same ... but I'm thinking that is it useful

I believe I found the solution to my problem last night (I'll have to wait for next week's content update to be 100% sure) - I had to make a config change for another, unrelated situation - and the commit failed.

An application which I had in a defined application group apparently just ceased to exist - and the config commit was failing because of that.

Part of the virus/content upgrade involves re-committing the active config to the device - and I think that is what was causing my upgrades to report an error.

I'll check the next content update (I apply them manually because I've been bitten - badly - in the past by allowing automatic content updates to be done without oversight/vetting) and post a reply here I turn out to be right.

[dreputi]

Hi,

Few things you can check are:

-Make sure in the 'download & install' section there is no 'Threshold' value configured. By default it will be blank but if it was configured, the firewall will see if the update is atleast those many hours old, if not it will not install it.

-Follow ms.log and look for the time stamp at which your update is supposed to occur, it can give more details on 'threshold' or any communication issues etc.

>less mp-log ms.log

-You can also look at paninstaller.log, at the very bottom check which version it is showing. If it shows an older version but the GUI shows latest is installed, it actually may not be installed. You can try to revert to previous version first and upgrade again.

> less mp-log paninstaller_content.log

-There could be communication issues/server issues.

-Corrupt files from past.(Uncommon)

-Also issues with normal commit due to config like Darren mentioned above.

Hope it helps a little.

Regards,

Dileep

[darren_g]

> -Also issues with normal commit due to config like Darren mentioned above.

This was definitely the problem in my case - confirmed it now.

It's annoying that this application definition just disappeared - with, from memory, no notifications (at least, I don't recall any of the recent notices for content updates notifying of this being changed) - although it *is* possible I missed it.