topic Re: Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1 in Expedition Discussions

Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

Esfeld — Thu, 12 Jul 2018 19:43:23 GMT

I was able to parquet logs every day for 10 days. After the upgrade, Expedition no longer sees new files. Path and permissions have not changed.

A stand-alone firewall has no issue.

Should I delete the Pano and managed devices and recreate?

Re: Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

Esfeld — Mon, 16 Jul 2018 15:31:45 GMT

I deleted the Panorama device which removed all child devices. Rebooted Expedition. Re-added Panorama, generated API key, downloaded Panorama devices, downloaded running config, look for logs under machine learning, still no results. All files in the Expedition screen cap were already converted to parquet format.

Re: Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

dgildelaig — Thu, 19 Jul 2018 18:37:55 GMT

Should we do a Zoom session to check it further?

Please, contact us at fwmigrate at paloaltonetworks dot com.

Re: Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

Esfeld — Thu, 19 Jul 2018 21:09:51 GMT

Many thanks to dgildelaig for helping me understand the solution. I had logs, but they were empty because the firewall had failed over. Here is what I believe to be the best practice. He will correct me if I am wrong.

Configure both firewalls in an HA pair to do log export.

On both firewalls, test the SCP twice. The first time so that they have the key stored, the 2nd for it to create the test file and you know it worked.

Under the device configuration of both devices in Expedition, specify the HA device serial number so that it will look for logs from either of them. Expedition checks to make sure the file has more than just headers. If it doesn't, it won't even show up in the file list for Processing.

Re: Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

axtiooon — Mon, 30 Jul 2018 08:14:48 GMT

Hi, did the tool showed an "No supported files to process" Error in the M.Learning tab?

Thanks in advance,

Andre

Re: Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

dgildelaig — Mon, 30 Jul 2018 08:54:35 GMT

If you get the "Not supported files to process" means that Expedition, in the given path, did not find files that belong to that PANOS device and/or are from a PANOS version older than 7.1 or newer than 8.1.

If the files are, for instance, from a PANOS 6.1, you should still see the file int he list, with a description stating that it is a non-supported log format.

Re: Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

JohnMaki — Tue, 02 Jul 2019 14:44:47 GMT

Does this apply to files from a device runing 9.0.X? I am having this issue and mine are on 9.

Re: Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

dgildelaig — Tue, 02 Jul 2019 14:58:53 GMT

9.0 should be supported now.

Re: Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

JohnMaki — Tue, 02 Jul 2019 15:21:32 GMT

Ok it was user error. It works now. Thanks Sandro!!

Re: Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

dgildelaig — Tue, 02 Jul 2019 15:57:27 GMT

Not sure if you refer to me, or Sandro gave you also additional feedback.

If so, maybe you could describe the issue resolution for other users that may encounter the same problem.

Re: Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

JohnMaki — Tue, 02 Jul 2019 17:11:25 GMT

Oh sorry! Sandro responded from the fwmigrate email list.

I didn't realize you had to expand out the Panorama device and process the logs on the firewall level within Expedition instead on the collapsed Panorama Devices.