A log event with "Config installed" as the description appears in the system logs even though a configuration change or a commit operation has not been performed.
Cause
The Palo Alto Networks device will log an event with "Config installed" in the system logs on the following automated actions:
Antivirus, application, threat and other dynamic updates
Automatic commit
FQDN refresh
To confirm which events are causing the "Config installed" messages:
Navigate to Monitor > System
Filter on: ( description contains 'Config installed' )
From the CLI, enter the following command to show all finished jobs including the types mentioned above: > show jobs processed
Match the timestamps for the "Config installed" rows with those from the finished jobs list to determine which actions generated the events.