MLAV cloud error, all machine Learning engines stopped

[KAckerman12]

Received this high-alert message on a PA5220 (10.0.8-h4) this morning, "MLAV cloud error, all machine Learning engines stopped". Has anyone else received this message before? If so, what steps should I take to troubleshoot and resolve the message? Thank you.

[OtakarKlier]

Hello,

I have seen this a few times. Honestly I just wait to see if it clears itself as its usually an issue not on things I control, e.g. internet routing, issues Palo Alto might be having, etc. If it goes on topo long 24+ hours. I open a ticket.

Regards,

[KAckerman12]

I was wondering whether it was within my control or not. I'll continue to monitor and if I keep getting the errors I'll open a ticket. Thank you for the response!

[KAckerman12]

I received this alert a few hours later, "Reconnect to MLAV cloud, enable all machine Learning engines". Issue resolved itself.

[Gun-Slinger]

Did anyone get more definitive information on this? Curious if this is something that can for the most part be ignored or a trend for an underlying issue. This isn't often that this comes up but find it strange that 1 cluster would display this alert and none of our others.

[KAckerman12]

Did it recently happen to you around the beginning of April? That's when I got my most recent alert. Fixed itself within 24 hours.

[YEmreSeven]

You may run to check machine learning cloud status "show mlav cloud-status".

[Lee_S]

Hi,

We had same this Wednesday 8/31 on PA-5220 HA pair, v10.0.11.  When We check the cloud status it shows 'connected'.  Maybe We won't see it again after updating to 10.1 soon.

[KAckerman12]

@Lee_S, I have been on 10.1 for some time, and I don't recall seeing this error message since then. How about you? Have your PA-5220's experienced this since upgrading?

[LorneLong]

I had the same problem on a Pa 5220(10.2.3)

[ksalustro]

Saw this on a PA-450 with 10.2.4. The fw was not acting well, the device certificate listed abbreviated info but said it was valid. The mgt port was disconnected to Panorama, although I could web into it ok. All the authentications were failing since the fw could not do lookups. Lots of other errors also, fw can't get its updates, errors in the system log include "Validation of Local client certificate failed resulting in error 58, Problem with the local SSL certificate" and "DNS Security cloud service connection refused." etc. We failed over to the secondary for now, and I'll try to come back to put an update here after troubleshooting.

[Cindy_Tanner]

On code 10.2.7. hardware 3220. December 28 2023. what is this MLAV alert?

[dpecken]

Just got it on one of my firewalls today...interestingly, not the active member of the HA pair.  I intend to see if it clears.  Every time we've seen alerts related to Palo cloud stuff they've mysteriously cleared after I filed a ticket, and no one at Palo could offer a reason for the issue.

[Momentum]

Just got it on all my firewalls today 10.2.8.  Logged a ticket.  Pending reply.  

Running "show mlav cloud-status" stated is connected.

Does anyone has update on this issues?

[jthmpsn2]

No help or further info for you, but the same thing is happening on both of our PAs (10.2.8, although I don't think that's the cause here). May open a ticket if it doesn't subside, I'm assuming it's on the Palo Alto side of things.

"MLAV: Unknown error."

Fairly useless error message, seeing no other issues, or any related or pertinent log entries that would help.

Again, no help, but at least you're not the only one having the issue.