Threat Database Handler (Commit Error)

120368

Created On 09/25/18 18:55 PM - Last Modified 06/10/22 05:40 AM

Antivirus

Dynamic Updates

Content Release

Device Management

7.1

7.0

9.0

PAN-OS

Symptom
Commit to a Palo Alto Networks device fails with the following error:

Threat database handler failed
Commit failed
Failed to commit policy to device

Cause

Reason 1. In certain cases, the AV update process or content update process might be terminated abruptly without any indication as to why. This isssue is seen more often in the PA-200, but other platforms like the PA-3000 also exhibit the issue. The corrupt AV signature database or content database will cause these commit failures.

Reason 2. The firewall may be running a PAN-OS version earlier than 8.1, and it may have installed a Content package that is newer than what is supported.

Resolution

Workaround

Reason 1. A manual Anti-Virus install from the CLI will serve as a workaround for this issue. Download the Anti-Virus file manually from https://support.paloaltonetworks.com > Dynamic Updates and upload the same to the Palo Alto Networks firewall. After the upload, use the following command to do the manaul AV install from the CLI.

> request anti-virus upgrade install file
panup-all-antivirus-2276-2715.candidate.tgz 2016/02/23 15:21:13 97473.4K 
panup-all-antivirus-2283-2722.candidate.tgz 2016/03/01 15:27:58 102607.3K 
<value>

If this workaround does not work or you get a "Server error" then contact Palo Alto Networks TAC for support.

Resolution

Reason 1. There is a known issue that is resolved in PAN-OS versions 7.1.2, 7.0.8 and 6.1.13.

Reason 2. As per the Palo Alto Networks end-of-life (EoL) summary (determined by the end-of-life (EoL) policy), PAN-OS 7.1 and PAN-OS 8.0 reached end-of-life on June 30, 2020, and October 31, 2019, respectively. Content updates will remain available for download but support will not be provided for content related issues on PAN-OS 7.1 and PAN-OS 8.0.

Troubleshooting

To verify this error, look into the device server logs, which will indicate the following error messages related to the AV cache error:

> less mp-log devsrv.log

2016-02-24 01:39:29.493 -0500 [TDB] Load virus cache now
2016-02-24 01:39:29.493 -0500 load virus cache /opt/pancfg/mgmt/updates/curav/
2016-02-24 01:39:29.493 -0500 Virus - Content Engine version: 0x7000000 version 6e308c2,
min_threat_version 92007b , path /opt/pancfg/mgmt/updates/curav/
2016-02-24 01:39:29.814 -0500 Error: pan_tdb_do_load_virus_serialize(pan_tdb_ser.c:735): Virus
version mismatch 0x6df08be vs 0x6e308c2
2016-02-24 01:39:29.862 -0500 Error: pan_tdb_do_load_virus_cache(pan_tdb_handler.c:365): [TDB]
Load /opt/pancfg/mgmt/updates/curav//cache/virus.cache.ser-8 error, will load again
2016-02-24 01:39:29.862 -0500 [TDB] Loaded path /opt/pancfg/mgmt/updates/curav/ cache loaded 0
skip 0
2016-02-24 01:40:10.202 -0500 Error: pan_tcomp_sqlite3_compile(pan_tcomp_sqlite3.c:295): SQL
error: database disk image is malformed

Attachments

Threat Database Handler (Commit Error)

Workaround

Resolution

Troubleshooting

Other users also viewed: