Redistribution Agent UserID(vsys1): details: close connection to agent

[Reynold]

I recieved this system alert every 10mins. 

Redistribution Agent UserID(vsys1): details: close connection to agent

Please help.

Thanks.

Rey

[rxie]

suggestions: 

1. >tail follow yes mp-log distributord.log  --- to look for error logs

2. if needed,  turn on debug or dump level logs

admin@PA-VM-Site-B(active)> debug distributord on  XXX 
 debug debug
 dump dump
 error error
 info info
 warn warn

3. check out https://live.paloaltonetworks.com/t5/customer-advisories/intermediate-certificate-authority-expiry-i...

[Reynold]

I got these error logs from tech support.

2022-08-01 11:00:55.141 +0800 Error: pan_user_id_agent_open_conn_i(pan_user_id_uia.c:2563): pan_user_id_ssl_conn_open(P xxx.xx.x.xx) failed: Error: Failed to connect to IP xxx.xx.x.x(IP xxx.xx.x.xx):5009
2022-08-01 11:00:55.141 +0800 Error: pan_user_id_agent_uia_show_config(pan_user_id_uia.c:2185): pan_user_id_agent_open_conn(IP xxx.xx.x.xx) failed: Error: Failed to connect to IP xxx.xx.x.xx(IP xxx.xx.x.xx):5009

any ideas how I could fix this?  Thanks.

[rxie]

-looks like transmit layer level reachability issue.

-make sure the firewall can reach the destination ip:5009 from the specified source of user-id service.

-take a tcpdump on the management port, then view the pcap:

> tcpdump filter "host X.X.X.X and port 5009"

> view-pcap mgmt-pcap mgmt.pcap

-might as well open a case to PA TAC

[Reynold · Accepted solution]

alright. I will check the source destination ip:5009

Thanks. will update soon.