Questions Regarding Output Difference in "show ctd-agent status security-client" Command

[h-sato183520]

Hi Team,

I have a question regarding the output of the “show ctd-agent status security-client” command.
My understanding is that this command displays the connection status between the firewall and the content cloud.
In our customer’s environment, I observed a difference in the command output after upgrading from version 10.2.x to 11.1.x.

[PAN-OS 10.2]
> show ctd-agent status security-client
Security Client UrlCat(2)
Current cloud server: urlcat.hawkeye.services-edge.paloaltonetworks.com:443
Cloud connection: connected

<snip>

[PAN-OS 11.1]
> show ctd-agent status security-client
Security Client WifUpload(0)
Current cloud server: hawkeye.services-edge.paloaltonetworks.com:443
Cloud connection: connected
<snip>

In version 10.2, “UrlCat” was displayed, but in 11.1 it disappeared and “WifUpload” appears instead.
I believe that each item corresponds to the following cloud services:

- UrlCat: Advanced URL Filtering service
- WifUpload: Advanced WildFire service

Questions:
1) From version 11.1 onward, has the output related to the Advanced URL Filtering Service simply been removed?
Or is there another reason for this change?

2) Can I understand that this is merely a “display difference” and that it does not cause any functional differences?

Background:
Our customer asked about this behavior. I have explained that it is a version-based output difference and should not affect  operation.
However, they have requested official confirmation that this difference is version-related and has no operational impact...

Best regards,

[Raido_Rattameister]

Check if commands below help you to find if it might have different syntax now.

find command keyword ctd

find command keyword ctd-agent

[Elwin3]

That change is expected between 10.2 and 11.1. In recent PAN-OS versions, the output of “show ctd-agent status security-client” was simplified to show only active or relevant modules. UrlCat isn’t gone; its reporting was moved under the Advanced URL Filtering process, so it no longer appears as a separate client entry. WifUpload now reflects WildFire’s upload service in the same section. It’s just a display update, not a functional difference.

The connection to both cloud services remains operational, and you can verify this by checking “show system services-status” or “debug device-server show” for confirmation.