When does the PAN-OS device check license information?
185
Created On 04/16/25 04:03 AM - Last Modified 10/23/25 19:42 PM
Question
When does the PAN-OS device check license information?
Environment
All PAN-OS devices
Answer
In case of pre PAN-OS 11.0, license check runs at around 4 am, but post PAN-OS 11.1 it runs a past 12 am. It will be executed when the existing licenses are expired in less than 30 days.
Additional Information
Log for PAN-OS 11.0.X
> show system info | match sw-version
sw-version: 11.0.3-h3
> show log system query equal "description contains 'License'"
Time Severity Subtype Object EventID ID Description
===============================================================================
2025/04/14 04:04:06 critical general general 0 License for feature url-filtering expired on 2025/04/11
2025/04/14 04:04:06 info general general 0 License information refreshed
2025/04/14 04:04:09 critical general general 0 License for feature threat expired on 2025/04/11
2025/04/14 04:04:13 critical general general 0 License for feature global-protect-portal expired on 2025/04/11
2025/04/14 04:04:16 critical general general 0 License for feature global-protect-gateway expired on 2025/04/11
2025/04/14 04:04:20 critical general general 0 License for feature pan-url-filtering expired on 2025/04/11
2025/04/14 04:04:24 critical general general 0 License for feature wildfire expired on 2025/04/11
2025/04/14 04:04:33 critical general general 0 License for feature dns-security expired on 2025/04/11
2025/04/14 04:04:37 critical general general 0 License for feature sd-wan expired on 2025/04/11Log for PAN-OS 11.1.X
> show system info | match sw-version
sw-version: 11.1.6-h3
> show log system query equal "description contains 'License'"
Time Severity Subtype Object EventID ID Description
=======================================================================================================
2025/04/15 00:46:15 info general general 0 License information refreshed
2025/04/15 00:46:17 critical general general 0 License for feature url-filtering expired on 2025/04/11
2025/04/15 00:46:18 critical general general 0 License for feature threat expired on 2025/04/11
2025/04/15 00:46:19 critical general general 0 License for feature global-protect-portal expired on 2025/04/11
2025/04/15 00:46:20 critical general general 0 License for feature global-protect-gateway expired on 2025/04/11
2025/04/15 00:46:21 critical general general 0 License for feature pan-url-filtering expired on 2025/04/11
2025/04/15 00:46:22 critical general general 0 License for feature wildfire expired on 2025/04/11
2025/04/15 00:46:26 critical general general 0 License for feature dns-security expired on 2025/04/11
2025/04/15 00:46:27 critical general general 0 License for feature sd-wan expired on 2025/04/11
2025/04/16 00:09:07 info general general 0 License information refreshed
2025/04/16 00:09:08 critical general general 0 License for feature url-filtering expired on 2025/04/11
2025/04/16 00:09:09 critical general general 0 License for feature threat expired on 2025/04/11
2025/04/16 00:09:10 critical general general 0 License for feature global-protect-portal expired on 2025/04/11
2025/04/16 00:09:11 critical general general 0 License for feature global-protect-gateway expired on 2025/04/11
2025/04/16 00:09:12 critical general general 0 License for feature pan-url-filtering expired on 2025/04/11
2025/04/16 00:09:14 critical general general 0 License for feature wildfire expired on 2025/04/11
2025/04/16 00:09:17 critical general general 0 License for feature dns-security expired on 2025/04/11
2025/04/16 00:09:19 critical general general 0 License for feature sd-wan expired on 2025/04/11This is just a license check timing on the device. This is regardless a license expiration timing on the license server side.