About fwmike

fwmike · ‎02-11-2020

@batd2 I've used bash scripts for this. You'll want to use ssh keys for the user authentication. Here is an example on how to dump the idmgr cache: #! /bin/bash ssh -t -t <username>@<device> << EOF set cli pager off debug device-server dump idmgr type vsys-region all quit EOF

fwmike · ‎01-06-2020

Unchecking Enable IPv6 Firewalling from Session Settings did not clear the tunnel interface warnings.

fwmike · ‎01-03-2020

@MP18 I'm still seeing the commit warnings with 8.1.9. Warning: tunnel tunnel.666 ipv6 is not enabled. IPv6 address will be ignored! (Module: rasmgr)

fwmike · ‎12-31-2019

Thanks @MP18 . To clarify my post, I still get the warnings on 8.1.9-h4 and 9.0.5 when the enable IPv6 on the interface is unchecked in the tunnel interface config. From what @fb-pan posted, this was going to be addressed in future code releases. I do not want to use the workaround.

fwmike · ‎12-30-2019

Not fixed in 9.0.x.

fwmike · ‎09-19-2019

Hi, @xhoms Thanks for this article. Works perfectly!

fwmike · ‎09-18-2019

https://live.paloaltonetworks.com/t5/MineMeld-Discussions/New-GitHub-Miner/td-p/229904 Haven't tried it yet but looks like a reasonable solution for restricting SSH to GitHub destinations.

fwmike · ‎05-13-2019

@TechnologySvcs , did you get this working? I require this capability in a new GP deployment and would like to avoid putting another device upstream to restrict the portal and gateway access by region. Thanks

fwmike · ‎02-07-2019

@lmori My case 01048381.

fwmike · ‎01-11-2019

@fl1654 It can also mean that destination TCP port 28270 is not reachable on the destination Panorama. Check the path between Panoramas for anything blocking that port.

fwmike · ‎01-07-2019

Thanks @jmeurer. Is there an ETA on the documentation? I've asked our SE for more details. @jmeurer wrote: Yes, we announced our intentions here. https://researchcenter.paloaltonetworks.com/2018/11/reinvent-2018-update-aws-security-hub-integration-aws-transit-gateway-support/ You can build it out manually today, it works and has been tested internally. We will be releasing additional documentation and templates soon. I would recommend reaching out to your account team for additional information.

fwmike · ‎01-04-2019

Hello, Is there planned AWS Transit Gateway integration? There is mention but no detail in this video: https://www.youtube.com/watch?v=6fhwoAwYrug Other than operational ease, the Transit Gateway advantages appear limited. Traffic between VPCs is not encrypted. VPC segmentation is via routing and does not traverse a firewall.

fwmike · ‎09-26-2018

Thanks. Is there a way to fix the apt-get update GPG signature error without rebuilding my instance?

fwmike · ‎09-25-2018

Same behavior on my MM.

fwmike · ‎09-25-2018

Thanks @xhoms. Do you have any idea when the regression will be fixed?

fwmike · ‎09-18-2018

I'm in complete agreement. Looking at building new instances and guidance and or clarity on OS support would be nice.

fwmike · ‎09-17-2018

I'm running Trusty. Sorry if the posting title misled. ubuntu@minemeld:~$ cat /etc/os-release NAME="Ubuntu" VERSION="14.04.5 LTS, Trusty Tahr" ID=ubuntu ID_LIKE=debian PRETTY_NAME="Ubuntu 14.04.5 LTS" VERSION_ID="14.04" HOME_URL="http://www.ubuntu.com/" SUPPORT_URL="http://help.ubuntu.com/" BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/" ubuntu@minemeld:~$

fwmike · ‎09-06-2018

Thanks. I was hoping the MM Discussion had some additional feedback. I appreciate the link to the build but it would be useful to determine the issue and avoid rebuilding a system that has worked fine for the last few years. In some environments, operationalizing systems with certificates, monitoring etc takes longer and involves more handoffs.

fwmike · ‎09-05-2018

Any way to address this without a rebuild?

fwmike · ‎09-05-2018

I have a related issue on an existing installation when updating the packages: ubuntu@minemeld:~$ sudo apt-get update Get:1 http://security.ubuntu.com trusty-security InRelease [65.9 kB] Get:2 http://security.ubuntu.com trusty-security/main Sources [161 kB] Get:3 http://minemeld-updates.panw.io trusty-minemeld InRelease [2,430 B] Get:4 http://security.ubuntu.com trusty-security/universe Sources [80.0 kB] Ign http://archive.ubuntu.com trusty InRelease Ign http://minemeld-updates.panw.io trusty-minemeld InRelease Get:5 http://security.ubuntu.com trusty-security/main amd64 Packages [763 kB] Get:6 http://archive.ubuntu.com trusty-updates InRelease [65.9 kB] Get:7 http://security.ubuntu.com trusty-security/universe amd64 Packages [245 kB] Ign http://minemeld-updates.panw.io trusty-minemeld/main amd64 Packages/DiffIndex Get:8 http://security.ubuntu.com trusty-security/main Translation-en [412 kB] Hit http://archive.ubuntu.com trusty-backports InRelease Get:9 http://security.ubuntu.com trusty-security/universe Translation-en [133 kB] Hit http://archive.ubuntu.com trusty Release.gpg Get:10 http://archive.ubuntu.com trusty-updates/main Sources [421 kB] Get:11 http://archive.ubuntu.com trusty-updates/restricted Sources [6,322 B] Get:12 http://archive.ubuntu.com trusty-updates/universe Sources [208 kB] Get:13 http://archive.ubuntu.com trusty-updates/multiverse Sources [7,441 B] Get:14 http://archive.ubuntu.com trusty-updates/main amd64 Packages [1,101 kB] Hit http://minemeld-updates.panw.io trusty-minemeld/main amd64 Packages Ign http://minemeld-updates.panw.io trusty-minemeld/main Translation-en_US Ign http://minemeld-updates.panw.io trusty-minemeld/main Translation-en Get:15 http://archive.ubuntu.com trusty-updates/restricted amd64 Packages [17.2 kB] Get:16 http://archive.ubuntu.com trusty-updates/universe amd64 Packages [473 kB] Get:17 http://archive.ubuntu.com trusty-updates/multiverse amd64 Packages [14.6 kB] Get:18 http://archive.ubuntu.com trusty-updates/main Translation-en [546 kB] Get:19 http://archive.ubuntu.com trusty-updates/multiverse Translation-en [7,616 B] Get:20 http://archive.ubuntu.com trusty-updates/restricted Translation-en [4,021 B] Get:21 http://archive.ubuntu.com trusty-updates/universe Translation-en [253 kB] Hit http://archive.ubuntu.com trusty-backports/main Sources Hit http://archive.ubuntu.com trusty-backports/restricted Sources Hit http://archive.ubuntu.com trusty-backports/universe Sources Hit http://archive.ubuntu.com trusty-backports/multiverse Sources Hit http://archive.ubuntu.com trusty-backports/main amd64 Packages Hit http://archive.ubuntu.com trusty-backports/restricted amd64 Packages Hit http://archive.ubuntu.com trusty-backports/universe amd64 Packages Hit http://archive.ubuntu.com trusty-backports/multiverse amd64 Packages Hit http://archive.ubuntu.com trusty-backports/main Translation-en Hit http://archive.ubuntu.com trusty-backports/multiverse Translation-en Hit http://archive.ubuntu.com trusty-backports/restricted Translation-en Hit http://archive.ubuntu.com trusty-backports/universe Translation-en Hit http://archive.ubuntu.com trusty Release Hit http://archive.ubuntu.com trusty/main Sources Hit http://archive.ubuntu.com trusty/restricted Sources Hit http://archive.ubuntu.com trusty/universe Sources Hit http://archive.ubuntu.com trusty/multiverse Sources Hit http://archive.ubuntu.com trusty/main amd64 Packages Hit http://archive.ubuntu.com trusty/restricted amd64 Packages Hit http://archive.ubuntu.com trusty/universe amd64 Packages Hit http://archive.ubuntu.com trusty/multiverse amd64 Packages Hit http://archive.ubuntu.com trusty/main Translation-en Hit http://archive.ubuntu.com trusty/multiverse Translation-en Hit http://archive.ubuntu.com trusty/restricted Translation-en Hit http://archive.ubuntu.com trusty/universe Translation-en Ign http://archive.ubuntu.com trusty/main Translation-en_US Ign http://archive.ubuntu.com trusty/multiverse Translation-en_US Ign http://archive.ubuntu.com trusty/restricted Translation-en_US Ign http://archive.ubuntu.com trusty/universe Translation-en_US Fetched 4,990 kB in 9s (551 kB/s) Reading package lists... Done W: GPG error: http://minemeld-updates.panw.io trusty-minemeld InRelease: The following signatures were invalid: KEYEXPIRED 1531657138 KEYEXPIRED 1531657138 KEYEXPIRED 1531657138 KEYEXPIRED 1531657138 The offending key seems to show as expired and attempting to fetch a new one fails: ubuntu@minemeld:~$ sudo apt-key list /etc/apt/trusted.gpg -------------------- pub 1024D/437D05B5 2004-09-12 uid Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com> sub 2048g/79164387 2004-09-12 pub 1024D/FBB75451 2004-12-30 uid Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com> pub 4096R/C0B21F32 2012-05-11 uid Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com> pub 4096R/EFE21092 2012-05-11 uid Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com> pub 4096R/DD0DA1F9 2016-07-15 uid Palo Alto Networks, MineMeld Team <minemeld@paloaltonetworks.com> uid [jpeg image of size 3523] /etc/apt/trusted.gpg.d/minemeld.gpg ----------------------------------- pub 4096R/DD0DA1F9 2016-07-15 uid Palo Alto Networks, MineMeld Team <minemeld@paloaltonetworks.com> uid [jpeg image of size 3523] ubuntu@minemeld:~$ sudo apt-key adv --recv-keys --keyserver keys.gnupg.net DD0DA1F9 Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/tmp.D97sGF9seu --no-auto-check-trustdb --trust-model always --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyring /etc/apt/trusted.gpg.d/minemeld.gpg --recv-keys --keyserver keys.gnupg.net DD0DA1F9 gpg: requesting key DD0DA1F9 from hkp server keys.gnupg.net gpgkeys: key DD0DA1F9 can't be retrieved gpg: no valid OpenPGP data found. gpg: Total number processed: 0 ubuntu@minemeld:~$

fwmike · ‎08-16-2018

Here's the current usage: ubuntu@minemeld:~$ ps auwx |grep -v grep | grep rabbitmq rabbitmq 22283 0.0 0.0 7500 312 ? S Aug10 0:03 /usr/lib/erlang/erts-5.10.4/bin/epmd -daemon rabbitmq 22304 0.0 0.0 4444 648 ? S Aug10 0:00 /bin/sh /usr/sbin/rabbitmq-server rabbitmq 22310 0.3 7.7 756584 159268 ? Sl Aug10 28:24 /usr/lib/erlang/erts-5.10.4/bin/beam -W w -K true -A30 -P 1048576 -- -root /usr/lib/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.2.4/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@minemeld -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@minemeld.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@minemeld-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.2.4/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@minemeld-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@minemeld" rabbitmq 22424 0.0 0.0 7464 428 ? Ss Aug10 0:00 inet_gethost 4 rabbitmq 22425 0.0 0.0 9556 656 ? S Aug10 0:00 inet_gethost 4 ubuntu@minemeld:~$

fwmike · ‎08-14-2018

Just ran into this. This worked: delete import network interface ethernet1/4.10

fwmike · ‎08-13-2018

fwmike · ‎08-10-2018

Adding another gig of RAM appears to have resolved my issue: ubuntu@minemeld:~$ free total used free shared buffers cached Mem: 2049924 1950076 99848 672 206312 953164 -/+ buffers/cache: 790600 1259324 Swap: 0 0 0 FWIW, we have 13 miners, 8 procs and 8 outputs.

fwmike · ‎08-02-2018

Thanks for checking in. The failure happened again and the log shows low memory errors: ubuntu@minemeld:~$ sudo grep memory /opt/minemeld/log/minemeld-engine.log | tail -10 2018-08-02T13:57:21 (31689)amqp._blocked ERROR: Connection blocked: low on memory 2018-08-02T13:57:24 (31689)amqp._blocked ERROR: Connection blocked: low on memory 2018-08-02T13:57:24 (31689)amqp._blocked ERROR: Connection blocked: low on memory 2018-08-02T13:57:24 (31689)amqp._blocked ERROR: Connection blocked: low on memory 2018-08-02T13:57:24 (31689)amqp._blocked ERROR: Connection blocked: low on memory 2018-08-02T13:57:25 (31689)amqp._blocked ERROR: Connection blocked: low on memory 2018-08-02T13:57:25 (31689)amqp._blocked ERROR: Connection blocked: low on memory 2018-08-02T13:57:25 (31689)amqp._blocked ERROR: Connection blocked: low on memory 2018-08-02T13:57:25 (31689)amqp._blocked ERROR: Connection blocked: low on memory 2018-08-02T13:58:27 (31689)amqp._blocked ERROR: Connection blocked: low on memory ubuntu@minemeld:~$ I restarted MM and see total Mem usage steadily increasing: top - 14:51:54 up 55 days, 23:46, 2 users, load average: 0.00, 0.01, 0.05 Tasks: 94 total, 2 running, 92 sleeping, 0 stopped, 0 zombie %Cpu(s): 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st KiB Mem: 1017736 total, 762240 used, 255496 free, 21184 buffers KiB Swap: 0 total, 0 used, 0 free. 161496 cached Mem PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 7330 ubuntu 20 0 103080 2048 1060 S 0.3 0.2 0:02.18 sshd 7399 minemeld 20 0 60608 14800 1896 S 0.3 1.5 0:00.77 supervisord 7419 minemeld 20 0 417048 92920 7464 S 0.3 9.1 0:07.02 gunicorn 1 root 20 0 33504 1416 56 S 0.0 0.1 0:01.53 init 2 root 20 0 0 0 0 S 0.0 0.0 0:00.19 kthreadd 3 root 20 0 0 0 0 S 0.0 0.0 0:18.47 ksoftirqd/0 5 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 kworker/0:0H 7 root 20 0 0 0 0 S 0.0 0.0 2:37.20 rcu_sched 8 root 20 0 0 0 0 R 0.0 0.0 4:03.51 rcuos/0 9 root 20 0 0 0 0 S 0.0 0.0 0:00.00 rcu_bh 10 root 20 0 0 0 0 S 0.0 0.0 0:00.00 rcuob/0 11 root rt 0 0 0 0 S 0.0 0.0 0:00.00 migration/0 12 root rt 0 0 0 0 S 0.0 0.0 0:20.51 watchdog/0 VM has 1 CPU and 1 GB RAM. Will request additional RAM to see if it helps.

fwmike · ‎07-23-2018

When Automatically Acquire Commit Lock is enabled on Panorama 8.0.10, is there a way to prevent an admin from creating another lock while a different admin already has one? We use shared objects almost exclusively and with four administrators are often in situations where multiple locks are getting created. This leads to reaching out to the other admins to make sure they are done and if it's ok for lock removal so all changes can be commited. Has anyone else experienced this behaviour and either come up with a different setting or work flow that smooths it out?

fwmike · ‎07-23-2018

Is there a permanent fix for this issue? My MM instance keeps stopping and downgrading PIP per the instructions above revives it. ubuntu@minemeld:~$ sudo service minemeld stop * Stopping: minemeld [ OK ] ubuntu@minemeld:~$ sudo -H -u minemeld /opt/minemeld/engine/current/bin/pip install pip==9.0.3 The directory '/home/minemeld/.cache/pip/http' or its parent directory is not owned by the current user and the cache has been disabled. Please check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag. The directory '/home/minemeld/.cache/pip' or its parent directory is not owned by the current user and caching wheels has been disabled. check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag. Requirement already satisfied: pip==9.0.3 in /opt/minemeld/engine/0.9.48.post1/lib/python2.7/site-packages /opt/minemeld/engine/0.9.48.post1/local/lib/python2.7/site-packages/pip/_vendor/urllib3/util/ssl_.py:339: SNIMissingWarning: An HTTPS request has been made, but the SNI (Subject Name Indication) extension to TLS is not available on this platform. This may cause the server to present an incorrect TLS certificate, which can cause validation failures. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings SNIMissingWarning /opt/minemeld/engine/0.9.48.post1/local/lib/python2.7/site-packages/pip/_vendor/urllib3/util/ssl_.py:137: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings InsecurePlatformWarning /opt/minemeld/engine/0.9.48.post1/local/lib/python2.7/site-packages/pip/_vendor/urllib3/util/ssl_.py:137: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings InsecurePlatformWarning You are using pip version 9.0.3, however version 18.0 is available. You should consider upgrading via the 'pip install --upgrade pip' command. ubuntu@minemeld:~$ sudo service minemeld start * Starting: minemeld Unlinking stale socket /var/run/minemeld/minemeld.sock [ OK ] ubuntu@minemeld:~$

Date Registered	‎02-28-2015 07:54 AM
Date Last Visited
Total Messages Posted	27
Total Likes Received	4

Strata

Prisma

Cortex

About fwmike