Threat-pcap download fails with error “XXXX.pcap not present” when parallel exporting threat-pcap APIs are called.
3787
Created On 06/17/24 00:04 AM - Last Modified 08/20/24 04:55 AM
Symptom
- XML APIs are used to download Threat-pcap.
- The download fails with API response “XXXX.pcap not present.
- This happens when downloaded APIs are called in parallel.
- The XML API for downloading Threat-pcap gets like the following response when those APIs are called in parallel.
<?xml version="1.0"?>
<response status="error">
<msg>
<line>/opt/pancfg/session/pan/user_tmp/4814264219446509/1152921504606846976.pcap not present</line>
</msg>
</response>Environment
- Next Generation Firewall
- PAN-OS: 9.1 or later.
- XML API
Cause
In the current implementation, the XML API for downloading the threat-pcap cannot be run in parallel.
Resolution
Run the XML API sequentially to download threat-pcap.
Additional Information
If req_stats.log has same log messages that are XML APIs for downloading threat-pcap within 1 sec, it indicates that those XML APIs might be called in parallel.
- req_stats.log
2024-06-05 21:09:43.402 | 2024-06-05 21:09:43.402 | 2024-06-05 21:09:43.402 | 2024-06-05 21:09:44.082 | 0 | 0.00 msecs | 679.48 msecs | 9202 | <request cmd="op" cookie="9202659739653343" refresh="no"><operations xml="yes"><download><threat-extpcap><pcapid>1152921504606846976</pcapid><search-time>2024/06/04 21:49:05</search-time><device_name>PA-3410</device_name><sessionid>54</sessionid>
2024-06-05 21:09:44.313 | 2024-06-05 21:09:44.314 | 2024-06-05 21:09:44.313 | 2024-06-05 21:09:44.997 | 0 | 0.00 msecs | 684.20 msecs | 5151 | <request cmd="op" cookie="5151491533863496" refresh="no"><operations xml="yes"><download><threat-extpcap><pcapid>1152921504606846976</pcapid><search-time>2024/06/04 21:49:05</search-time><device_name>PA-3410</device_name><sessionid>55</sessionid>
2024-06-05 21:09:44.371 | 2024-06-05 21:09:44.371 | 2024-06-05 21:09:44.371 | 2024-06-05 21:09:45.063 | 0 | 0.00 msecs | 692.06 msecs | 6320 | <request cmd="op" cookie="6320397012768083" refresh="no"><operations xml="yes"><download><threat-extpcap><pcapid>1152921504606846976</pcapid><search-time>2024/06/04 21:50:25</search-time><device_name>PA-3410</device_name><sessionid>56</sessionid>