(PAN-OS 12.2.2 and later) To view the health state of cluster
services and signature sync status, run:
admin@WF-500(active-controller)>show cluster membership
The cluster membership output includes an aggregated health state
for the cluster. The CLI reports the following values, which correspond
to the color-coded health indicators in the Panorama web interface:
Healthy (Green in UI)—All services are operational.
Degraded (Yellow in UI)—One or more management plane or signature
generation services are degraded but core services remain operational.
Unhealthy (Red in UI)—One or more core services are down (Database,
Messaging, or WildFire Services).
The output also includes the cross-cluster signature sync status,
which reports one of the following:
Healthy—Signature sync is operational.
Unhealthy—Signature sync is enabled but not functioning correctly
(for example, API keys are not configured for all remote clusters).
opt-out—Signature sync is not active (default state
after upgrading to PAN-OS 12.2.2).
warning—Sync is partially operational but experiencing
issues.
The following example shows a healthy cluster with signature sync
enabled:
admin@WF-500(active-controller)> show cluster membership
Cluster Health Status: Healthy
Service Summary: wfpc signature
Cluster name: mycluster
Address: 10.1.1.10
Host name: wf-node-1
Node name: wfpc-012345000001-internal
Serial number: 012345000001
Node mode: controller
Server role: True
HA priority: primary
Last changed: Sun, 12 Jul 2026 22:25:26 -0700
Services: infra signature wfcore wfpc
Node Health Status:
012345000001: Healthy
012345000002: Healthy
012345000003: Healthy
Monitor status:
Serf Health Status: passing
Agent alive and reachable
Service 'infra' check: passing
Application status:
global-queue-service: JoinedCluster
global-db-service: Ready
siggen-db: ReadyMaster
wildfire-management-service: Done
wildfire-apps-service: Ready
signature-sync: Healthy
sync-from remote-cluster: Healthy
Work queue status:
sample analysis queued: 0
sample analysis running: 0
sample copy queued: 0
sample copy running: 0
The following example shows the show cluster all-peers
output, where signature sync status appears on controller nodes but not
on worker nodes:
admin@WF-500(active-controller)> show cluster all-peers
Address Mode Server Node Name
------- ---- ------ ---------
10.1.1.10 controller Self True wf-node-1
Service: infra signature wfcore wfpc
Status: Connected, Server role applied
Changed: Sun, 12 Jul 2026 22:25:26 -0700
WF App:
global-queue-service: JoinedCluster
global-db-service: Ready
siggen-db: ReadyMaster
wildfire-management-service: Done
wildfire-apps-service: Ready
signature-sync: Healthy
sync-from remote-cluster: Healthy
10.1.1.20 controller Peer True wf-node-2
Service: infra signature wfcore wfpc
Status: Connected, Server role applied
Changed: Sun, 12 Jul 2026 22:29:21 -0700
WF App:
global-queue-service: JoinedCluster
global-db-service: JoinedCluster
siggen-db: ReadySlave
wildfire-management-service: Done
wildfire-apps-service: Ready
signature-sync: Healthy
sync-from remote-cluster: Healthy
10.1.1.30 worker True wf-node-3
Service: infra wfcore wfpc
Status: Connected, Server role applied
Changed: Fri, 10 Jul 2026 15:32:03 -0700
WF App:
global-queue-service: JoinedCluster
global-db-service: Ready
siggen-db: Stopped
wildfire-management-service: Done
wildfire-apps-service: Ready
Signature sync status is visible on active and passive controller
nodes only; worker nodes do not display sync status in the
show cluster all-peers output.
To view the signature sync enablement state specifically, run:
admin@WF-500> wildfire-cross-cluster-signature-sync status
Cross cluster signature synchronization status: enabled
