topic Re: Expedition ML - not able to find the CSV files from SYSLOG in Expedition Discussions

Expedition ML - not able to find the CSV files from SYSLOG

Mboghdady — Fri, 23 Jul 2021 04:12:48 GMT

I'm unable to find the CSV files that were sent from the FW as (expedition is a syslog)

below are the ML settings:

------------------------------------------------------------

expedition@Expedition:/PAlogs$ ls -l
total 8
drwxrwxrwx 2 expedition www-data 4096 Jul 20 00:00 172.16.16.5
-rwxrwxrwx 1 expedition expedition 17 Jul 17 00:51 ssh-export-test.txt
expedition@Expedition:/PAlogs$

----------------------------------------

Re: Expedition ML not able to find file under directory created with Imported log files

lychiang — Tue, 20 Jul 2021 02:08:37 GMT

@Mboghdady Have you upgrade your ubuntu by any chance , if you did "sudo apt-get upgrade" , it will break the dependence package that required by Expedition and you will need to re-install a fresh ubuntu server.

Re: Expedition ML not able to find file under directory created with Imported log files

Mboghdady — Tue, 20 Jul 2021 02:17:42 GMT

Hi , Thanks for your message,I usually use the below :

sudo apt-get update
sudo apt-get install expedition-beta

Re: Expedition ML - not able to find the CSV files

Mboghdady — Thu, 22 Jul 2021 03:58:54 GMT

I can see and process all the files that exported from the FW (using Scheduled Log Export ) but still the issue on the CSV files that come from Syslog

Re: Expedition ML - not able to find the CSV files from SYSLOG

Mboghdady — Fri, 23 Jul 2021 04:31:17 GMT

Any suggestion?

Re: Expedition ML - not able to find the CSV files from SYSLOG

dgildelaig — Fri, 23 Jul 2021 09:28:30 GMT

Expedition will check that the serial number in the log file fits with the serial number you have defined for the device in Expedition.

I would suggest two things:

- Verify you have defined the serial correctly, if not, you could enter the correct serial as a HA serial. If this work, you may consider creating the device again with the valid serial.

- If serial is already correct, you can enter the PATH as /PALogs/*.csv

Expedition will check recursively the folders and show all the files that belong to the device. If this works, please let me know and I will check if the issue is about having dots "." in the path you are providing.

Re: Expedition ML - not able to find the CSV files from SYSLOG

Mboghdady — Fri, 23 Jul 2021 19:10:03 GMT

Hi,

- I have verified the serial number by checking the CSV that was received from the FW and it's the same as the configured under the Devices tab on the expedition:

expedition@expedition:~$ tail /PALogs/172.16.16.5/******_traffic_2021_07_23_last_calendar_day.csv

then I tried to remove the device and added it again.

- I tried to enter the CSV path to : /PALogs/172.16.16.5/*.csv and still unable to see the files.

Re: Expedition ML - not able to find the CSV files from SYSLOG

azuniga — Mon, 26 Jul 2021 04:00:50 GMT

Hello @Mboghdady

Go ahead and shoot an email over to fwmigrate@paloaltonetworks.com and maybe we can set up a session to take a look at your issue.

Re: Expedition ML - not able to find the CSV files from SYSLOG

Mboghdady — Sat, 31 Jul 2021 01:04:14 GMT

Solved after upgrade the Expedition version to 1.1.105