topic Re: Problems with importing logs in Expedition Discussions

Problems with importing logs

staustin — Fri, 01 Jun 2018 23:58:57 GMT

I've added a panorama device into Expedition and i'm trying to import logs that I've exported from panorama and am running into an issue. I put the csv file in /home/expedition/logs. The csv is called panorama.csv. /home/expedition/logs/* (logs path in expedition). I've changed changing permissions on the file/folder and ownership and no matter what, the csv doesn't show up in expedition for importing. Any ideas?

Re: Problems with importing logs

Tim_Grossner — Sat, 02 Jun 2018 00:33:20 GMT

Try exporting the logs from the firewall(s) instead. Worked for me, and we have Panorama as well.

Re: Problems with importing logs

alestevez — Mon, 04 Jun 2018 09:22:56 GMT

Expedition does filter by serial number. So when you dfined your Panorama you assigned a Serial there but inside the logs exported from panorama it will show the Serials from the Firewalls who were generating the logs so there is no coincidence and for instance you wont be able to see the CSV files under your Panorama....

The right approach will be adding Panorama, retrieve the connected devices and then from the devices imported into the one you want to focus then add the CSV files under it. From the project perpective you have to add panorama, import the panorama config and from the log connector select the devicegroup where your firewall is part and Expedition will take care of everything else.

Re: Problems with importing logs

Brad.Herbert — Wed, 06 Jun 2018 20:04:29 GMT

Ok, I've added my Panorama Device, retrieve connected devices and they show up. Now, I've scheduled a Log Export on my M-100 (Setup in Log Collector Mode Only), however I'm not getting the log into my /home/expedition/logs/ directory. I'm using SCP to send directly to my Expedition VM. Doing a LS on that directory, i see the ssh-export-test.txt file that's created when the export was setup. Any suggestions?

Re: Problems with importing logs

joxbe — Fri, 22 Jun 2018 18:37:21 GMT

I'm still having this issue with a vm firewall that is not in panorama. I can see the log in the /home/expedition/logs folder but when using /home/expedition/logs/* and clicking on the search button it still is not finding any logs. I've tried this on other phsyical firewalls as well and expedition can't see any of them. Any thoughts?

Re: Problems with importing logs

alestevez — Mon, 25 Jun 2018 17:00:55 GMT

When you define Panorama you have to assign the panorama serial, If you are adding the logs under your panorama but the logs were genrated by a firewall with a diffrent serial they will not be shown under panorama, you should has to retrieve cojnnected devices and then under the device configure the PATH....

Re: Problems with importing logs

Tim_Grossner — Tue, 26 Jun 2018 19:41:42 GMT

Have you thought about having the devices that are learned as part of Panorama "inherit" an M.Learning log path from the setting for Panorama?

Re: Problems with importing logs

alestevez — Wed, 27 Jun 2018 13:51:18 GMT

So that its already implemented, if oyu configure a PATH for Panorama all the devices managed by it will inherit the same PATH unless you override it...

Re: Problems with importing logs

Tim_Grossner — Wed, 27 Jun 2018 14:00:27 GMT

Ah, yes. I went into the Panorama device profile and updated/saved the log path, and the firewalls below it all updated. Nice. I must have just biffed it somehow originally on the 3 firewall devices I was concentrating on.

Thanks!

Re: Problems with importing logs

Brad.Herbert — Thu, 05 Jul 2018 22:49:05 GMT

Anyone getting this to work? I've attached some screenshots,thoughts?No Logs Available to importDevices in Expedition. Physical Firewalls were added by PanoramaCSV File in /home/expedition/logs directoryScheduled Export from the Physical Firewall

Re: Problems with importing logs

staustin — Thu, 05 Jul 2018 23:18:39 GMT

I had to import logs from each firewall indvidually to get it to work.

Re: Problems with importing logs

dgildelaig — Fri, 06 Jul 2018 09:09:42 GMT

The logs will show under the firewall they belong too.

The belonging is done via the serial number (and the serialHA number).

Therefore, given a path for a device, we will show only the files that are on that path and that also share the serial number of that device.

Why is that?

Reason 1:
- We can place all the logs of multiple firewalls in the same folder /PALogs/* but we only want to see those logs that belong to each firewall, to be accurate with the firewall's context
Reason 2:
- We may have one panorama that handles 50 firewalls, having each firewall's files under /PALogs/firewall_X/*. We can set the path for Panorama to /PALogs/*, and all the managed devices (if they do not overwrite the given Panorama's path) will inherit the path, and will show only the files that belong to the firewall in place.
  Notice that we also list files that are in subfolders of a given path (if we have reading access to the folder)

Re: Problems with importing logs

Brad.Herbert — Tue, 10 Jul 2018 16:39:55 GMT

And to confirm you did this under M. Learning, correct? Regardless of what I try, in the Expedition GUI, I can never find the .csv files exported from the firewall to the Expedition Server. When I go to the server, the Logs are getting created and written to the server properly, just aren't able to be seen by the GUI.

Re: Problems with importing logs

devincallaway — Tue, 10 Jul 2018 16:52:38 GMT

Have you tired hitting them with a 777 hammer just to rule out permissions?

Re: Problems with importing logs

dgildelaig — Tue, 10 Jul 2018 17:15:15 GMT

Can you confirm that the FW you have defined in expedition has the same serial number as the serials reported in the logs?

And that the log path is correctly writen (without spaces)

And, could you try to check with the most recent update of Expedition?

If it continues failing, let's have a Zoom session to figure out the source of the issue. And we report back here the resolution once solved.

Re: Problems with importing logs

Brad.Herbert — Tue, 10 Jul 2018 18:57:51 GMT

I've confirmed the Serial number matches, and the path is correct. We're running Expedition on esxi host, so we had to convert the original image. Is there a way within expedition to "Check for Update" or do we need to convert the image to esxi again and re-install?

Re: Problems with importing logs

dgildelaig — Tue, 10 Jul 2018 19:16:39 GMT

Expedition comes as a software package.

It is simple to updtae it:
sudo apt-get update
sudo apt-get install expedition-beta

Notice that you may get a message to launch another command more to update some python modules. The command will come along the last lines of the "sudo apt-get install expedition-beta" output.

Re: Problems with importing logs

Brad.Herbert — Wed, 11 Jul 2018 13:28:45 GMT

Looks like the upgrade did the trick, thank you...