Machine Learning engine for Phishing stopped, please update your content

[mateuszg]

Hello.

From yesterday(26.05.2021) in two independent environments on the firewall I can see messages: "Machine Learning engine for Phishing stopped, please update your content".

Does anyone have a similar problem and know how to fix it?

Regards!

[TStiteler]

We are seeing the same alerts.  I've been digging all morning trying to find any information available on this and coming up empty so far.  Confirmed all content/signatures are updated to most recent versions.

Engine keeps starting, runs for about 9 minutes, and then stops and generates the alerts.

[jwilczek]

Have seen the same myself after I updated last night.  Anyone found a resolution? 

[mateuszg]

Hello.

I have VM-100, PAN-OS 10.0.1 in my lab, after upgrade signatures as below I started receive these messages. It's looks like problem with Dynamic Updates.

sw-version: 10.0.1
app-version: 8410-6722
av-version: 3728-4239
threat-version: 8410-6722
wildfire-version: 562165-565281
url-filtering-version: 20210527.20191
logdb-version: 10.0.2

Regards,

Mateusz

[jim.smith]

Same issue just started here with our 220 HA pair running 10.0.5.

Have received a stop, restart, and another stop within 15 min window.

[TStiteler]

Looks like it is resolved for us now.  Last "stopped" messages were received at 2:31pm EST and all of the FWs last reported the engine starting.  Nothing overly interesting in the system logs that looked different from previous connections to the update server or any content update delivery.  

[jim.smith]

I too have not had any further stops.
...fingers crossed

[jim.smith]

Spoke too soon...
Machine Learning engine for Phishing stopped, restarted, stopped...
(sigh)

[rob.bush]

I've been getting this for 2 days now.  I'm getting flooded with emails about this once every 5 minutes.

Machine Learning engine for Phishing stopped, please update your content

Machine Learning engine for Phishing started

[nikoolayy1]

Upgrade to the latest 10.6 version as 10.x is still new and prone to issues.

In the Masterd log there could be some info for the process rebooting, also check if the managment plane has a log with the same name as the process name that you see in  Masterd log  if not check in the GUI the system log. Also monitor your dataplane and managment plane CPU and the memory as it could be memory or cpu leakage bug. You may use the Palo Alto chrome extension for better monitoring:

https://live.paloaltonetworks.com/t5/blogs/get-more-gui-functionality-using-pan-w-achrome/ba-p/17807...

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-release-notes/pan-os-10-0-release-information/k...

[nikoolayy1]

Also have you checked the hard disk as I renember similar issue because of full hard disk partition? Here is how to check if the disk is full:

https://live.paloaltonetworks.com/t5/general-topics/troubleshooting-and-investigating-full-hard-disk...

[Metgatz]

Hello @mateuszg 

Good afternoon, did you try to update your Dynamic Content Updates ?

Best regards

[OtakarKlier]

Hello All,

You can sign up for service alerts and maintenance at the following link.

https://status.paloaltonetworks.com/

Regards,

[AndrzejPiotrowski]

Hi, Today I see the same massage on my firewall: Machine Learning engine for PE stopped, please update your content. (messages were stop and start as well). What doe's it mean? 

I try to reopen this issue...