Description

After the Junos upgrade on SRX series devices, the following error could be observed at the commit or commit check operation after the configuration change:

/var/db/idpd/sec-download/detector-capabilities.xml: parser error

The error states that the downloaded IDP files cannot be parsed and a new IDP detector files set should be downloaded.

Problem example:
 

/var/db/idpd/sec-download/detector-capabilities.xml:4637: parser error : Premature end of data in tag Contexts line 382
 <Parent>N ^ 
/var/db/idpd/sec-download/detector-capabilities.xml:4637: parser error : Premature end of data in tag DetectorCapabilities line 2 
 <Parent>N ^
 <xnm:error xmlns="http://xml.juniper.net/xnm/1.1/xnm" xmlns:xnm="http://xml.juni per.net/xnm/1.1/xnm">
<source-daemon>idpd
<edit-path>[edit security]
<statement>idp
<message>Please install the latest detector
error: configuration check-out failed
The IDP was mentioned in Junos default configuration under

groups {
junos-default{ 

This default Junos configuration group is protected, and because the configuration change commit cannot be performed it cannot be unprotected or changed as well creating a locked loop.

To resolve the IDP package downloader parse error: cleared the partially downloaded IDP files and IDP cache files
From SRX CLI:

request security idp storage-cleanup cache-files request security idp storage-cleanup downloaded-files

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/request-security-idp-storage-cleanup.html

 

 

 

Symptoms

/var/db/idpd/sec-download/detector-capabilities.xml:4637: parser error : Premature end of data in tag Contexts line 382
 <Parent>N ^ 
/var/db/idpd/sec-download/detector-capabilities.xml:4637: parser error : Premature end of data in tag DetectorCapabilities line 2 
 <Parent>N ^
 <xnm:error xmlns="http://xml.juniper.net/xnm/1.1/xnm" xmlns:xnm="http://xml.juni per.net/xnm/1.1/xnm">
<source-daemon>idpd
<edit-path>[edit security]
<statement>idp
<message>Please install the latest detector
error: configuration check-out failed

Solution

If the SRX device has internet access, then the IDP detector files can be downloaded and installed one more time:
 

https://www.juniper.net/documentation/us/en/software/junos/idp-policy/topics/topic-map/security-idp-basic-configuration.html
 

If the SRX has no internet connectivity, the old IDP files from previous Junos release can be cleared from SRX CLI:

request security idp storage-cleanup cache-files
request security idp storage-cleanup downloaded-files

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/request-security-idp-storage-cleanup.html

Modification History

2024-02-06 : Article Created

Related Information

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/request-security-idp-storage-cleanup.html