topic Unable to connect log collector to panorama in VM-Series in the Public Cloud

Unable to connect log collector to panorama

BabajideM — Tue, 29 Mar 2022 21:35:01 GMT

I have a panorama VM running on Azure, I am currently trying to bring up some log collector VMs also on azure to handle the logs of my firewalls.

I have been able to deploy the log collectors, but when I add the log collector to the panorama through the "Managed collectors" section, I do not get any connection status, the connection status is just blank.

I can ping the IP of the log collector from the panorama and vice-versa, but I am unable to connect the log collector to the panorama.

On checking the mp.logs of the log collector, i see this error -

Error: pan_cmsa_tcp_channel_setup(src_panos/cms_agent.c:1196): panorama agent: SSL connect error. sock=16 err=1

On checking the panorama-status on the log collector, the panorama connected state is "No"

Kindly let me know if you have seen something similar and how you fixed it.

Re: Unable to connect log collector to panorama

PavelK — Wed, 30 Mar 2022 23:20:29 GMT

Thank you for the post @BabajideM

could you check below points:

1.) Make sure that Log Collector's serial number and password in Panorama under Managed Log Collectors are correct.

2.) Make sure that PAN-OS of Log Collector is the same or lower than the one running on Panorama.

3.) I would also make sure that log collector is configured to use the same time zone as Panorama and that DNS server is configured:

set deviceconfig system timezone <Time Zone>
set deviceconfig system dns-setting servers primary <IP address> secondary <IP address>

4.) Make sure log collector is added to log collector group and push the configuration to log collector group by: Commit > Push to Devices > Collector Groups > [Log Collector name].

5.) Make sure that App content version installed on Log Collector is the same as the one on Panorama.

6.) On Panorama side, I would check the output from: show netstat numeric yes | match 3978

Could you also take packet capture on Panorama side? You can use Log Collector's IP address as a filter. Make sure that TCP 3978 between Panorama and Log Collector are open.

Kind Regards

Pavel

Re: Unable to connect log collector to panorama

AndreaConsadori — Thu, 05 Jun 2025 07:55:10 GMT

This save my day.