Cortex Cloud Scan Failures - "The workload either timed out or terminated"

Cortex Cloud Scan Failures - "The workload either timed out or terminated"

195
Created On 12/23/25 13:19 PM - Last Modified 03/26/26 18:55 PM


Symptom


  • Agentless Disk Scanning and/or registry scanning displays a warning message in the Data Sources for the onboarded Account.
  • Analysis of the cloud_health_auditing dataset or XQL queries reveals that the most common error message is The workload either timed out or terminated.
    • XQL:
      • dataset = cloud_health_auditing | filter capability in ("Registry","ADS") and classification in ("Warning","Error","Failed") 


Environment


  • Product: Cortex Cloud (CWP module)
  • Features: Agentless Disk Scanning (ADS), Registry Scanning
  • Cloud Providers: AWS, GCP, Azure


Cause


  • Transient Behavior
    • The Cortex Cloud scanning architecture is designed to be cloud-native, using ephemeral, cost-optimized virtual machines (often Spot Instances in AWS or Preemptible VMs in GCP) to perform scans.
      • These instances can be reclaimed by the cloud provider at any time if the capacity is needed elsewhere. When this happens mid-scan, the workload is terminated, and this error is logged, this is an expected behavior.


Resolution


  • No immediate action is required. The Cortex Cloud platform is designed to handle this by automatically retrying the scan on the affected asset within the next 24-hour cycle. Future platform releases aim to improve logging to reduce the visibility of this expected "noise."


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000wkCEKAY&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail