topic Re: Manual processing of ML logs is greyed out in Expedition Discussions

Manual processing of ML logs is greyed out

BenKnorr2 — Thu, 03 Sep 2020 16:37:30 GMT

I have one instance of Expedition where I am apparently unable to manually trigger log processing for enabled files (Devices/M.learning). Initially, Expedition was set to autoprocess CSV files, and it did it successfully. After a reboot, three logfiles piled up due to scheduled log export via scp from firewall and I didn't notice that the task manager for expedition wasn't started until after the three piled up.

Since this box got stood up, the "Process Enabled Files" button is greyed out. Any ideas?

Re: Manual processing of ML logs is greyed out

azuniga — Thu, 03 Sep 2020 17:15:59 GMT

@BenKnorr2

Can I see a screenshot of it being greyed out? Attached is what I see on my current environment.

Re: Manual processing of ML logs is greyed out

BenKnorr2 — Thu, 03 Sep 2020 18:08:09 GMT

1 CSV pending...

I also noticed that automatic processing isn't finishing either. I administratively disabled a file for processing and when doing that, Expedition changes the device from "PA-52xxx" to "PA-50xxx" (I have both types in this panorama, fwiw). Changing back to enabled changes the FW type back to 5250. Not sure what that's about or if it matters. The button for processing enabled files never changes than what is shown here. In my lab, I can process manually, but not on this particular instance of Expedition. All log files present are named consistently with PA52xxx, and I've verified that SN in logs matches the 5250 I'm targeting for ML.

Noticing that automatic processing isn't succeeding either, I've found my sparkRAM was only defined as 1100mb. I've updated that to 7000mb, will try again via daily automatic processing by adjusting time.

Re: Manual processing of ML logs is greyed out

senlees1 — Wed, 07 Oct 2020 14:59:48 GMT

Hello, mine is greyed out as well. Was there a fix to this?

Re: Manual processing of ML logs is greyed out

BenKnorr2 — Wed, 07 Oct 2020 17:48:35 GMT

Figured this out in another thread related to "unable to delete logs after autoprocessing." Turns out in my case, my FW (that is managed by Panorama) was sending logs to expedition, and I had configured Panorama as the device in Expedition. Everything worked because Expedition gets the running config of Panorama, including the FW in question. Problems that arose were this greyed out manual processing option, and it wasn't deleting logs after autoprocessing.

In Expedition/Devices, you need to change the view from its default "show grouped by Panorama" to "show all devices", then go into the FW in question where logs are coming from, then do the manual processing/autoprocessing from there instead. https://live.paloaltonetworks.com/t5/expedition-discussions/forwarded-logs-not-deleting-after-processing/m-p/352800#M3010 . Frustrating that it allows you to do most of it through Panorama, but there is no indication why those last bits aren't available/working.

Re: Manual processing of ML logs is greyed out

senlees1 — Thu, 08 Oct 2020 22:37:02 GMT

Awesome! That worked. Thank you.