topic Re: Panorama receiving logs but stop showing in GUI in Panorama Discussions

Panorama receiving logs but stop showing in GUI

Jitaphon — Thu, 24 Nov 2022 03:16:34 GMT

I found the issue about Panorama receives logs just fine but on GUI stop and saw the last record was two weeks ago, not show new log on GUI.

I try to restart process logd and restarted management server but not fix.
I found disks shows unavailable in panorama.
Status elasticsearch process is running and status log collector is green.
Panorama 10.1.6-h6

Please let me know, If someone who know the way to fix this issue.

Re: Panorama receiving logs but stop showing in GUI

Metgatz — Fri, 25 Nov 2022 04:38:34 GMT

H @Jitaphon i, something similar happened to me.

The solution by TAC, in the first instance was to restart the elasticsearch service in PANORAMA. Despite the restart, the service was not up, therefore the solution from TAC was directly the restart.

We decided to take advantage of the restart to upgrade from 9.1.4 to 9.1.14. After the reboot, the logs are gradually appearing correctly in PANORAMA.

Best regards

Re: Panorama receiving logs but stop showing in GUI

TorokAdam — Mon, 28 Nov 2022 14:40:33 GMT

Can you paste the output of

"show log-collector-es-cluster health"

Do you have any unallocated shards?

Re: Panorama receiving logs but stop showing in GUI

Jitaphon — Wed, 30 Nov 2022 04:12:14 GMT

Thanks, after restart elasticsearch process, we found log already shows on GUI Panorama and the collector statistics status is available. So, the possible cause of the issue is after pan-os upgrading and rebooting right?

Re: Panorama receiving logs but stop showing in GUI

TorokAdam — Wed, 30 Nov 2022 12:06:38 GMT

Most likely yes. In my case it was only after restarting Panorama (but elasticsearch had unallocated shards and support had to delete them with root access). Good news is, upgrading from 10.2.2 to 10.2.3 had no problems with elasticsearch. Did you perhaps changed Panorama mode from Legacy to Panorama? That may have also caused the issue.