Antivirus Download and Install Hanging

[cverniani]

Pa11.0.1 onPa820 in High Avaliability mode.

The antivirus download and install update job has been at the "download in progress" status for several hours.

The last antivirus valid is:4406 -4923 of 31/03/2023.

The following resolution answer does not work

Resolution [Not work]

• Run the following commands to clear the stuck download job:
  > debug software restart device-server          [This command does not work]
  > debug software restart management-server [This command does not work]
  

[PavelK]

Hello @cverniani

could you try these commands instead?

debug software restart process management-server
debug software restart process device-server

Kind Regards

Pavel

[cverniani]

Using the commands you wrote the system accepts:

debug software restart process management-server
debug software restart process device-server

and the system accept ok. [The syntax now is ok]

But the both systems does not complete the new antivirus installing commands.

Both the systems remain at the 59% of the progress.

In the last few days I have updated the system by manually restarting the appliances but new antivirus updates appear every day and it is important that PA can install the updates automatically.

The problem appeared only after updating the PA 820 to version 11.0.1.

[mlane]

Any other solutions?  I am having the same problem with a PA-820 HA pair on 11.0.1-h2.  The passive is updating, but the active sticks at 59% for last few days.

[cverniani]

I have opened a case on PA support and they wrote:

>>PANOS 11 may be prefered for newer firewalls, but with the 820 staying with the prefered 10 version may be better for you until >>Palo recommend to upgrade to 11 for the 820.

[cut] 

>>If this does not work, would you consider downgrading the firmware to 10.2.4-h2? This may be the better choice for your 820.

I have downgrade the firmware to 10.2.4-h2. 

I solved in this way.

[ozheng]

That is just a workaround, and fortunately, it seems you did not have strong business requirement to run on PAN-OS 11.0.

Would you mind sharing the case number?

Thank you.

Olivier

[mlane]

In my case I bought a new pair of PA-1410 firewalls.  I upgraded PA-820 to v11 to prepare for config migration from 820 to 1410.  I suspended the problematic 820 firewall (failover to passive) and restarted it last night.  AV updated.

[ozheng]

If you have Panorama, you simply move devices in template stack / device group.

(but that is out of scope of this topic)

[EquipeRESEAUXLFF]

Hello,

I have two PA-220, already 10.2.4-h2 and I have exactly the same issue.

I don't know how to resolve it...

[mlane]

We are currently working around this issue (until fixed in later version of 11) by disabling telemetry.

[stevegreen0]

I have PA-220's running 10.2.5 which fail to install the Antiviris Update.

I have found that Mlane's response above about disabling Telemetry resolves the issue for me (although it still takes time to install).

[JavierChueca]

Hello:

We are facing similar issue, our use case matches with:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NOKCA2&lang=en_US%E2%80%A...

I hope this helps.

Regards.