Why is the Update server communication occurring every 15 minutes with no dynamic update schedule defined
11488
Created On 04/24/20 17:48 PM - Last Modified 05/04/20 18:37 PM
Question
Why is my device connecting to the updates server every 15 minutes when no schedule exists?
Environment
- PAN-OS 8.1 and above.
- Palo Alto Firewall.
- No dynamic updates scheduled to check every 15 minutes.
Answer
Starting in PAN-OS 8.1 there is a new feature for 'Critical Content Alerts' where Palo Alto Networks can send a notification to your Panorama or firewall that there is a critical content alert. This feature is a script that runs every 15 minutes, this script goes out to check the updates server and retrieve whether or not there is a critical content alert.
Note: This is an additional notification avenue, the original communication method of emails will still be sent. At the time [April 2020] the script's schedule cannot be changed.
Additional Information
New Content Inspection features can be found here.
Due to this new feature, System logs display connection to update server every 15 minute:
Connection to Update server: updates.paloaltonetworks.com completed successfully, initiated by x.x.x.x
In the management plane logs, "get_content_issue_msg.log" are displayed indicating the script in action.
admin@firewall> less mp-log get_content_issue_msg.log
Tue Apr 21 11:15:35 CDT 2020
/root/.wgetrc is empty
/usr/local/bin/panupdater.sh -supdates.paloaltonetworks.com -tget_content_issue_msg
-G1 -A1 -y/tmp/pan/get_content_issue_msg.wgetrc -f
successfully query Update Server for content issue related message !!!
empty message returns from update server, but reset cfg.content-issue-msg-version to
notifiy mgmtsrvr to delete expired message in config xml tree in RAM
set cfg.content-issue-msg-version=1 returns: 0