Data Patterns with REGEX caused Panorama commit/push to fail on the firewall with error message "Threat database handler failed"
3663
Created On 01/29/22 00:34 AM - Last Modified 02/06/25 21:58 PM
Symptom
- After importing Panorama config, Panorama Device Group configuration commit fails with error message "Thread database handler failed" on the firewall.
- This can be seen from debug log of the firewall device-server (less mp-log devsrv.log):
- This article addresses one of the issue of "Thread database handler failed" message when Data Patterns with Regex is pushed to Firewall.
Error: pan_regex_load_regex_group(pan_tdb_aho.c:441): Cannot find aho file.
Error: pan_tdb_compile_patterns(pan_tcomp_tdb.c:3266): load regex error
write regex to appid 1 is_cts 1
Error: pan_regex_group_add_trans(pan_regex_group.c:454): too many similar trans from string 44
Error: pan_regex_add_group_trans(pan_regex.c:943): pan_regex_group_add_trans() failed
Error: pan_regex_state_add_trans(pan_regex.c:876): pan_regex_add_group_trans() failed
Error: pan_regex_construct_impl(pan_regex.c:1210): pan_regex_add_string() failed
Error: pan_regex_group_add_regex(pan_regex_group.c:206): pan_regex_construct(.*((Test Site)|(test site))) failed
Error: pan_tdb_compile_patterns(pan_tcomp_tdb.c:3298): pan_regexp_construct() failed
Error: pan_tdb_post_compile(pan_tcomp_tdb.c:2428): pan_tdb_compile_patterns error on appid 2
Error: __pan_tdb_handler(pan_tdb_handler.c:1108): pan_tdb_compile() failed
start to destruct s_tdb
start to destruct mlav_info
start to destruct mlav_info 0x556b60d95a80
Error: main(tdb_compile.c:439): pan_tdb_handler error
EXITED 1, STAT 255,
Error: pan_ctrl_compile_tdb(pan_config_handler_sysd.c:592): pan_tdb_compile_run() failed.
TDB compilation done, return -1
Config commit phase1 failedEnvironment
- Panorama 10.1.3
- Firewall VM 10.0.7
- Data Patterns with Regex is pushed to Firewall.
Cause
Panorama configuration contained invalid or misconfigured REGEX data patterns.
Resolution
The resolution in this case is to delete all the configured data patterns from Panorama object configuration being push from Panorama to the to the device groups.
Steps:
- Create a test object and perform local commit on Panorama (Commit to Panorama). Verify if successful.
- Create a test object and perform local commit on the firewall. Verify if successful.
- If both local commits on Panorama and firewall were successful, then it is like the config push from Panorama to the DG (Device Group) is causing the commit to fail on the firewall.
- Next, from firewall CLI, enable debug for device server using the command "debug device-server on debug" and "tail follow yes mp-log devsrv.log".
- Execute a config commit/push from Panorama to the DG.
- On firewall CLI, observe the log generated and/or save CLI output to text file. Search for "Error" in the log. Look for regex error as seen from the above.
- From Panorama web UI, go to DeviceGroup Objects > Custom Objects > Data Patterns. Delete or remove the data patterns causing the failure. In above example, REGEX data patterns for "Test Site" seems to be the one causing the commit failure. Delete the data patterns and also the Data Filtering profiles (Security Profiles > Data Filtering) associated to it.
- After deleting the data patterns and profile, try again the commit/push from Panorama. The commit will be successful on the firewall.
- If the commit fails, you may have to delete additional data patterns and data profiles (repeat step#7-8) until the commit is successful.
- Set debug for device server back to default setting using command "debug device-server on info".