About NKKrishnan

In particular we discovered that methods of creating configuration backups are not consistent across the various management interfaces.  It appears as if the most restore-able version of the backup has to be done from the GUI.   The 'export'/'scp'/'tftp' command may be equivalent, however they do not seem to allow access to the auto-saved configurations.   The TFTP export method needs to be enhanced to support a PATH.   The API version does not generate the leading  <?xml version="1.0"?> and the lack of newlines (and white space) makes it less that ideal for line based 'diff' tools.  Of course these are relatively easily remedied via 'tidy' and other mechanisms. ... View more

In a new installation of Expedition upon first login we had three issues to remediate:   1. The instructions for "Verify that the SQL_Log_bin flag in MariaDB is set to off" were clear enough.  So that was addressed successfully.   2. Insufficient instructions for "Verify that the Log_bin flag in MariaDB is set to off".  Verify that the Log_bin flag in MariaDB is set to off Log_bin is ON Remediation: Set log_bin to OFF A search did not come up with instances of log_bin:   root:/etc/mysql# grep -i log_bin `find /etc/mysql -type f` /etc/mysql/my.cnf:skip-log_bin = /var/log/mysql/mariadb-bin /etc/mysql/my.cnf:skip-log_bin_index = /var/log/mysql/mariadb-bin.index root:/etc/mysql#   3. Insufficient instructions for "Verify the PanOrders agent is running to accept background jobs" Verify the PanOrders agent is running to accept background jobs PanOrders Agent is stopped Remediation: Start the agent A look at services located panReadOrders, but no PanOrders   root:/etc/mysql# service --status-all | grep -i pan [ - ] panReadOrders root:/etc/mysql# service panReadOrders status ● panReadOrders.service - LSB: starts panReadOrders agent for Expedition Loaded: loaded (/etc/init.d/panReadOrders; bad; vendor preset: enabled) Active: active (running) since Fri 2020-02-21 08:57:37 PST; 3 days ago Docs: man:systemd-sysv-generator(8) Process: 40502 ExecStart=/etc/init.d/panReadOrders start (code=exited, status=0/SUCCESS) Tasks: 2 Memory: 11.7M CPU: 4.871s CGroup: /system.slice/panReadOrders.service ├─40508 sudo -u www-data php /var/www/html/console/messaging/readOrders.php └─40512 php /var/www/html/console/messaging/readOrders.php Feb 21 08:57:27 asa2pan systemd[1]: Starting LSB: starts panReadOrders agent for Expedition... Feb 21 08:57:37 asa2pan systemd[1]: Started LSB: starts panReadOrders agent for Expedition. Feb 21 08:57:37 asa2pan sudo[40508]: root : TTY=unknown ; PWD=/ ; USER=www-data ; COMMAND=/usr/bin/php /var/www/html/console Feb 21 08:57:37 asa2pan sudo[40508]: pam_unix(sudo:session): session opened for user www-data by (uid=0) root:/etc/mysql#   A bit more checking revealed a script:   root:/tmp# find / -print > filelist root:/tmp# grep -i panorder filelist /var/www/html/libs/PaloAltoNetworks/HealthCheck/PanOrdersAgentCheck.php root:/tmp#   No change in symptoms after   root@asa2pan:/tmp# service panReadOrders restart   or root@asa2pan:/tmp# service panReadOrders stop root@asa2pan:/tmp# service panReadOrders start   Suggestions on how to overcome these are welcome.  Thanks. ... View more