Other Administrators are holding device wide commit locks

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Other Administrators are holding device wide commit locks

L0 Member

Hi Guys,

 

i have actually the problem that i cant do any commit, there are two pending commits and if i try to commit the following message appearing:

 

"Error Other Administrators are holding device wide commit locks". 

 

Even when im logged in as the administrator who did the commit the same message appears. The Administratoraccounts are supperusers.

3 REPLIES 3

L7 Applicator

You can check to see the admins who have a commit lock via the UI or CLI:

 

> show commit-locks

Commit locks are designed to prevent any other logged in admins (even other superusers) from doing a commit until the lock is released. If you're a superuser, and you see commit locks from the CLI command above, you can clear them with: 

 

> request commit-lock remove 

For the GUI version, check this document:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CltACAS

Cyber Elite
Cyber Elite

Hello,

Commit locks are a good way to ensure there is no administrator poisoning. Meaning if one makes a change and antoehr makes a change, they could  accidentally break or revert the first admins changes.

 

Regards,

L1 Bithead

That’s not always the case—it could simply be a generic message that Panorama is displaying. I encountered a similar issue while working with a 5450 Firewall, where I was the only one connected to Panorama. Despite having the template marked as active and using the "force template values" option, I couldn’t push any template configuration to the firewall.

The configuration appeared to be copied to the destination firewall, but I noticed that certain elements—such as the virtual wire, untrust/trust zones, and interfaces 1/1 and 1/2—were already present on the local firewall, even though I hadn’t configured them myself. When I checked the XML file in Panorama, these configurations were not present in the template.

After spending hours trying to resolve the issue—detaching and reattaching the firewall, resetting it, downgrading and upgrading—it turned out the effective solution was to treat the firewall as a completely new device. Here's what worked:

1. Perform a factory reset on the firewall.

2. Reboot the device.

3. Delete the default configurations (zones, interfaces 1/1 and 1/2, virtual wire, and default router).

4. Commit the changes.

5. Attach the firewall to Panorama.

6. Verify that the firewall is connected to Panorama.

7. Push the configuration from Panorama to the firewall, ensuring that “force template values” is selected.

After following these steps, everything worked as expected.

  • 17306 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!