SYSTEM ALERT : medium : MLAV: Unknown error

[KirkH]

Repeatedly receiving the above alert on 4 separate PA firewalls throughout the evening, can't find much information online relating to it. Has anyone else received this message before? If so, what steps should I take to troubleshoot and resolve the message. currently running versions 10.2.6-h3 and 11.0.3-h10. Thanks

[zhangfw]

问同样的问题，我也发现了这个问题，今天突然出现了

[Dom17nj]

 Same here, comes every 5 minutes started yesterday. 10.1.13-h1. I have opened a case..

[gyoniku]

The same event is occurring in 10.2.7.

It was resolved by the command "debug software restart process device-server" on my PA-220.

However, the cause is unknown and is not an official solution.

[JosephGajda]

10.2.9-h1 same. 

[B.Toader]

Hello, 

After the command receive from Support not works, the messages appear after 30 -40 minutes again .

Please perform  show mlav cloud-status   if the services it's still busy that is the reason why not send messages 

Thank you 

[DanielWaldmeier]

 Same here, comes every 5 minutes started yesterday. 10.2.10. 

[Charles-SFG]

Same here.

[Charles-SFG]

We also see it on the passive firewall in active/passive HA. I wouldn't expect a passive firewall to be sending anything the the cloud for analysis.

[B.Toader]

https://live.paloaltonetworks.com/t5/general-topics/system-alert-medium-mlav-unknown-error/m-p/59312...

[gyoniku]

---

---

I got this in CSP.

“MLAV: Unknown error.” messages seen in the system logs every 5 minutes

There is no decrease in security coverage with this error.
This issue here is not impacting traffic and the firewall can maintain the same level of security coverage using the most recent content update.
Our engineering team is working on fixing the issue with the error messages.

[MP18 · Accepted solution]

I fixed the issue by running command 

debug software restart process device-server  on both Active and passive PA.

Version 10.2.8-h3

Issue Fixed

Regards

[SunilGugilapu]

Did you get any update from support ?

[KirkH]

solution provided from support:

Kindly restart the device server using the command mentioned below and let me know if it is helpful
>> debug software restart process device-server

Note:
In most cases, restarting the device server or management server will not cause any impact on traffic passing through the data plane. These two processes are major parts of the device's management plane processing.

[DanielWaldmeier]

Issue seem to be fixed without doing anything.

Most probably the AV dynamic update of 2024-07-26 fixed it again.