https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-app-log-collection-and-troubleshooting-faq/ta-p/388735 <DIV class="lia-message-template-content-zone"> <P><SPAN style="font-weight: 400;">This FAQ is about the feature described </SPAN><A href="https://live.paloaltonetworks.com/t5/blogs/solving-remote-access-challenges-in-the-covid-19-era/ba-p/384882" target="_blank" rel="noopener"><SPAN style="font-weight: 400;">here</SPAN></A><SPAN style="font-weight: 400;">.</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <P><SPAN style="font-weight: 600;">Is this feature available for Prisma Access and NGFW customers?</SPAN></P> <P>&nbsp;</P> <P><SPAN style="font-weight: 400;">GlobalProtect App Log Collection is available for Prisma Access customers using 1.8 Plugin and above. It will be available soon for NGFW customers.</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <P><SPAN style="font-weight: 600;">What platforms is this feature available for?</SPAN></P> <P>&nbsp;</P> <P><SPAN style="font-weight: 400;">Windows, macOS, Linux, Android, and iOS.</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <P><SPAN style="font-weight: 600;">Are there any OS specific limitations?</SPAN></P> <P>&nbsp;</P> <P><SPAN style="font-weight: 400;">Navigate to the </SPAN><STRONG>App Access Performance</STRONG><SPAN style="font-weight: 400;"> section in </SPAN><A href="https://docs.paloaltonetworks.com/globalprotect/10-0/globalprotect-admin/globalprotect-app-log-collection-for-troubleshooting/view-the-globalprotect-app-troubleshooting-and-diagnostic-logs-on-the-explore-app/details-within-the-globalprotect-app-troubleshooting-and-diagnostic-logs.html" target="_blank" rel="noopener"><SPAN style="font-weight: 400;">this</SPAN></A><SPAN style="font-weight: 400;"> document to view.</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <P><SPAN style="font-weight: 600;">Is this feature enabled by default for all users?&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN style="font-weight: 400;">Administrator has to enable this feature by setting “Enable App Log for Troubleshooting” to “Yes.” For a full list of prerequisites, visit </SPAN><A href="https://docs.paloaltonetworks.com/globalprotect/10-0/globalprotect-admin/globalprotect-app-log-collection-for-troubleshooting/checklist-for-globalprotect-app-log-collection-for-troubleshooting.html" target="_blank" rel="noopener"><SPAN style="font-weight: 400;">here</SPAN></A><SPAN style="font-weight: 400;">.</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <P><SPAN style="font-weight: 600;">Can I enable this setting for a specific user group before doing a company-wide deployment?</SPAN></P> <P>&nbsp;</P> <P><SPAN style="font-weight: 400;">Since this is available as a portal client app configuration, it can be applied to a user/user group allowing administrators to test with a small user group before attempting a company-wide deployment.</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <P><SPAN style="font-weight: 600;">Do I have to download another certificate to secure communications between GlobalProtect on the endpoint and the Cortex Data Lake Instance?</SPAN></P> <P>&nbsp;</P> <P><SPAN style="font-weight: 400;">Yes, administrators will be able to </SPAN><A href="https://docs.paloaltonetworks.com/globalprotect/10-0/globalprotect-admin/globalprotect-app-log-collection-for-troubleshooting/set-up-globalprotect-connectivity-to-cortex-data-lake" target="_blank" rel="noopener"><SPAN style="font-weight: 400;">download the certificate using CLI</SPAN></A><SPAN style="font-weight: 400;"> in Prisma Access 1.8 Plugin. With Prisma Access 2.0 Innovation Plugin, administrators will be able to download the certificate using the Cloud Services plugin UI. For Prisma Access Tenants, the certificate will get downloaded to Mobile_User_Template and Location “Shared.” With NGFW deployments, admin can choose a template/template stack to download to, that the portal configuration is a part of.</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <P><SPAN style="font-weight: 600;">Is there a diagram that explains how this works?</SPAN></P> <P><SPAN style="font-weight: 600;"><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Screen Shot 2021-03-02 at 5.17.30 PM.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/30143i8A617CAA0320DDE4/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Screen Shot 2021-03-02 at 5.17.30 PM.png" alt="Screen Shot 2021-03-02 at 5.17.30 PM.png" /></span></SPAN></P> <P>&nbsp;</P> <OL> <LI style="font-weight: 400;" aria-level="1"><SPAN style="font-weight: 400;">Admin requests the certificate from Panorama using Cloud Services Plugin 1.8 (using CLI) / 2.0 Innovation Plugin (using UI). Only innovation plugin would support the UI to generate and download the certificate.</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN style="font-weight: 400;">Certificate is downloaded to Panorama cert Store (1.8), Mobile_User_Template (Prisma Access Deployment), or template/template stack of admin’s choosing in case of NGFW. Admin decides to push the certificate via portal configuration.</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN style="font-weight: 400;">GlobalProtect authenticates with the portal</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN style="font-weight: 400;">GlobalProtect downloads the certificate&nbsp;</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN style="font-weight: 400;">Whenever user has authentication, network, or connectivity issues, user reports using the GlobalProtect App</SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><SPAN style="font-weight: 400;">These logs would be made available on Explore App </SPAN></LI> </OL> <P>&nbsp;</P> <P>&nbsp;</P> <P><SPAN style="font-weight: 600;">What do the logs contain? How different is it from the manual collection of logs?</SPAN></P> <P>&nbsp;</P> <P><SPAN style="font-weight: 400;">Logs contain troubleshooting and diagnostics data improving the overall quality of information and presented in an easy-to-read format enhancing administrator’s ability to quickly troubleshoot connectivity, authentication, and performance issues. Troubleshooting logs contain information specific to portal and gateway connectivity, and the network state of the endpoint. Diagnostics data contains data related to the Endpoint State, Gateway Network Impairments, GlobalProtect App Health, and App Access Performance. It is worth noting that the debug log bundle (collected manually via Troubleshooting tab on GlobalProtect or via Explore App) will also contain troubleshooting and diagnostic logs.</SPAN></P> <P><BR /><BR /></P> <P><SPAN style="font-weight: 600;">What information do each of the above troubleshooting and diagnostics tests contain?</SPAN></P> <P>&nbsp;</P> <P><SPAN style="font-weight: 400;">For a full list, navigate </SPAN><A href="https://docs.paloaltonetworks.com/globalprotect/10-0/globalprotect-admin/globalprotect-app-log-collection-for-troubleshooting/view-the-globalprotect-app-troubleshooting-and-diagnostic-logs-on-the-explore-app/details-within-the-globalprotect-app-troubleshooting-and-diagnostic-logs.html" target="_blank" rel="noopener"><SPAN style="font-weight: 400;">here</SPAN></A><SPAN style="font-weight: 400;">.</SPAN></P> <P><BR /><BR /></P> <P><SPAN style="font-weight: 600;">Are the diagnostic tests done with/without GlobalProtect tunnel?</SPAN></P> <P>&nbsp;</P> <P><SPAN style="font-weight: 400;">Yes, the Diagnostic Network Latency measurement tests are done once via GlobalProtect and once via physical adapter for administrators to compare and contrast what the latency measurements between endpoint and destination urls look like across the different interfaces.</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <P><SPAN style="font-weight: 600;">Where are the logs sent?</SPAN></P> <P>&nbsp;</P> <P><SPAN style="font-weight: 400;">Logs reported by end-users are sent to the customer’s Cortex Data Lake tenant and these logs are made available via the Explore App.</SPAN></P> <P><BR /><BR /></P> <P><SPAN style="font-weight: 600;">Can the GlobalProtect App Troubleshooting logs be forwarded from Cortex Data Lake?</SPAN></P> <P>&nbsp;</P> <P><SPAN style="font-weight: 400;">Log-forwarding is currently not supported. Coming soon in a future release.</SPAN></P> <P><BR /><BR /></P> </DIV> Wed, 03 Mar 2021 17:14:48 GMT vathreya 2021-03-03T17:14:48Z https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-app-log-collection-and-troubleshooting-faq/ta-p/388735 <P>Explore the most-asked questions about GlobalProtect App Log Collection. This guide is for the feature available to Prisma Access customers using 1.8 Plugin and above, and can help you navigate through common questions and provide answers.</P> Wed, 03 Mar 2021 17:14:48 GMT https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-app-log-collection-and-troubleshooting-faq/ta-p/388735 vathreya 2021-03-03T17:14:48Z https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-app-log-collection-and-troubleshooting-faq/tac-p/473965#M45 <P>Hi</P><P><SPAN>In a Panorama managed Prisma scenario does t</SPAN><SPAN>his feature require the</SPAN><SPAN>&nbsp;&nbsp;Autonomous DEM add-on license?</SPAN></P><P>&nbsp;</P><P><SPAN>Thanks</SPAN></P> Thu, 17 Mar 2022 08:54:24 GMT https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-app-log-collection-and-troubleshooting-faq/tac-p/473965#M45 Stuart_Gray 2022-03-17T08:54:24Z https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-app-log-collection-and-troubleshooting-faq/tac-p/560143#M73 <P>Hello/experts</P><P>&nbsp;</P><P>i really hate palo GP, we are facing one issue with our customer the case is going to much prolonged from 2 months,&nbsp;</P><P>every thing is working fine but global protect response is very slow.</P> Sun, 01 Oct 2023 18:37:36 GMT https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-app-log-collection-and-troubleshooting-faq/tac-p/560143#M73 AbdulAzim 2023-10-01T18:37:36Z https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-app-log-collection-and-troubleshooting-faq/tac-p/560187#M74 <P>We have open case with TAC more than 6 months whenever users connect to GP it internet brandwith drop from 1GB to 200Mbps .It had been with TAC more than 6 months no soultion more than 900 users are efffected due to this issue. Any one also have the same issue ?</P> Mon, 02 Oct 2023 08:04:54 GMT https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-app-log-collection-and-troubleshooting-faq/tac-p/560187#M74 Navid.Alam 2023-10-02T08:04:54Z