topic Re: Unable to get log forwarding to work in Panorama Discussions

Unable to get log forwarding to work

RRussellSplunk — Tue, 10 Oct 2023 20:14:14 GMT

Re: Unable to get log forwarding to work

RRussellSplunk — Tue, 10 Oct 2023 20:15:43 GMT

I'm configuring a lab NGFW and Panorama. Virtual on ESXi. My problem is that I have configured log forwarding as well as I can based on the articles I found, and the logs do not seem to be making it to Panorama. Show logging command from the NGFW:

admin@PA-VM> show logging-status verbose yes

-----------------------------------------------------------------------------------------------------------------------------

Type Last Log Created Last Log Fwded Last Seq Num Fwded Last Seq Num Acked Total Logs Fwded

-----------------------------------------------------------------------------------------------------------------------------

Log Collector : 000710015859

Conn ID : lr-10.1.16.190-2

Connection IP : 10.1.16.190

Conn Source IP : lr - def

High speed mode : Disabled

Connection Status : lr - Active

DNS :

msg : Successfully resolved FQDN for connid (lr-10.1.16.190-2-def), IP (10.1.16.190)

status : success

timestamp : 2023/10/07 19:45:38

Registration :

msg : Successful registration with lr-10.1.16.190-2-def

status : success

timestamp : 2023/10/07 19:45:39

SSL :

msg : ssl channel established

status : success

timestamp : 2023/10/07 19:45:39

TCP :

msg : tcp connection established

status : success

timestamp : 2023/10/07 19:45:38

Conn Uptime : 0

Re-conn Count : 0

Rate : 0 logs/sec

traffic 2023/09/06 05:48:28 2023/10/10 12:34:26 7273362867636814750 0 12864

threat Not Available Not Available 0 0 0

hipmatch Not Available Not Available 0 0 0

gtp-tunnel Not Available Not Available 0 0 0

auth Not Available Not Available 0 0 0

iptag Not Available Not Available 0 0 0

userid Not Available Not Available 0 0 0

sctp Not Available Not Available 0 0 0

decryption Not Available Not Available 0 0 0

config 2023/09/28 12:46:18 2023/10/10 12:34:58 7282416426768400408 0 31

system 2023/09/26 12:28:26 2023/10/10 13:11:02 7282416426768418241 0 87466

globalprotect Not Available Not Available 0 0 0

Log Collector : 000710015859

Conn ID : lr-10.1.16.190

Connection IP : 10.1.16.190

Conn Source IP : lr - def

High speed mode : Disabled

Connection Status : lr - Active

DNS :

msg : Successfully resolved FQDN for connid (lr-10.1.16.190-def), IP (10.1.16.190)

status : success

timestamp : 2023/10/07 19:45:38

Registration :

msg : Successful registration with lr-10.1.16.190-def

status : success

timestamp : 2023/10/07 19:45:39

SSL :

msg : ssl channel established

status : success

timestamp : 2023/10/07 19:45:39

TCP :

msg : tcp connection established

status : success

timestamp : 2023/10/07 19:45:38

Conn Uptime : 0

Re-conn Count : 0

Rate : 0 logs/sec

traffic 2023/09/06 05:51:23 2023/10/10 12:34:40 7273362867636814813 0 14180

threat Not Available Not Available 0 0 0

hipmatch Not Available Not Available 0 0 0

gtp-tunnel Not Available Not Available 0 0 0

auth Not Available Not Available 0 0 0

iptag Not Available Not Available 0 0 0

userid Not Available Not Available 0 0 0

sctp Not Available Not Available 0 0 0

decryption Not Available Not Available 0 0 0

config 2023/09/28 15:30:56 2023/10/10 12:35:03 7282416426768400419 0 36

system 2023/09/26 12:33:53 2023/10/10 13:11:11 7282416426768418320 0 95533

globalprotect Not Available Not Available 0 0 0

Log Collector : 000710015859

Conn ID : lr-10.1.16.190-1

Connection IP : 10.1.16.190

Conn Source IP : lr - def

High speed mode : Disabled

Connection Status : lr - Active

DNS :

msg : Successfully resolved FQDN for connid (lr-10.1.16.190-1-def), IP (10.1.16.190)

status : success

timestamp : 2023/10/07 19:45:38

Registration :

msg : Successful registration with lr-10.1.16.190-1-def

status : success

timestamp : 2023/10/07 19:45:39

SSL :

msg : ssl channel established

status : success

timestamp : 2023/10/07 19:45:39

TCP :

msg : tcp connection established

status : success

timestamp : 2023/10/07 19:45:38

Conn Uptime : 0

Re-conn Count : 0

Rate : 0 logs/sec

traffic 2023/09/06 05:51:38 2023/10/10 12:34:41 7273362867636814834 0 17518

threat Not Available Not Available 0 0 0

hipmatch Not Available Not Available 0 0 0

gtp-tunnel Not Available Not Available 0 0 0

auth Not Available Not Available 0 0 0

iptag Not Available Not Available 0 0 0

userid Not Available Not Available 0 0 0

sctp Not Available Not Available 0 0 0

decryption Not Available Not Available 0 0 0

config 2023/09/28 13:22:56 2023/10/10 12:35:01 7282416426768400414 0 42

system 2023/09/26 12:32:03 2023/10/10 13:11:08 7282416426768418290 0 116134

globalprotect Not Available Not Available 0 0 0

Log Collector : 000710015859

Conn ID : lr-10.1.16.190-4

Connection IP : 10.1.16.190

Conn Source IP : lr - def

High speed mode : Disabled

Connection Status : lr - Active

DNS :

msg : Successfully resolved FQDN for connid (lr-10.1.16.190-4-def), IP (10.1.16.190)

status : success

timestamp : 2023/10/07 19:45:38

Registration :

msg : Successful registration with lr-10.1.16.190-4-def

status : success

timestamp : 2023/10/07 19:45:39

SSL :

msg : ssl channel established

status : success

timestamp : 2023/10/07 19:45:39

TCP :

msg : tcp connection established

status : success

timestamp : 2023/10/07 19:45:38

Conn Uptime : 0

Re-conn Count : 0

Rate : 0 logs/sec

traffic 2023/09/06 05:52:43 2023/10/10 12:34:46 7273362867636814862 0 15516

threat Not Available Not Available 0 0 0

hipmatch Not Available Not Available 0 0 0

gtp-tunnel Not Available Not Available 0 0 0

auth Not Available Not Available 0 0 0

iptag Not Available Not Available 0 0 0

userid Not Available Not Available 0 0 0

sctp Not Available Not Available 0 0 0

decryption Not Available Not Available 0 0 0

config 2023/09/28 12:46:42 2023/10/10 12:34:59 7282416426768400410 0 38

system 2023/09/26 12:35:44 2023/10/10 13:11:15 7282416426768418335 0 106035

globalprotect Not Available Not Available 0 0 0

Log Collector : 000710015859

Conn ID : lr-10.1.16.190-3

Connection IP : 10.1.16.190

Conn Source IP : lr - def

High speed mode : Disabled

Connection Status : lr - Active

DNS :

msg : Successfully resolved FQDN for connid (lr-10.1.16.190-3-def), IP (10.1.16.190)

status : success

timestamp : 2023/10/07 19:45:38

Registration :

msg : Successful registration with lr-10.1.16.190-3-def

status : success

timestamp : 2023/10/07 19:45:39

SSL :

msg : ssl channel established

status : success

timestamp : 2023/10/07 19:45:39

TCP :

msg : tcp connection established

status : success

timestamp : 2023/10/07 19:45:38

Conn Uptime : 0

Re-conn Count : 0

Rate : 0 logs/sec

traffic 2023/09/06 05:52:53 2023/10/10 12:34:47 7273362867636814864 0 12060

threat Not Available Not Available 0 0 0

hipmatch Not Available Not Available 0 0 0

gtp-tunnel Not Available Not Available 0 0 0

auth Not Available Not Available 0 0 0

iptag Not Available Not Available 0 0 0

userid Not Available Not Available 0 0 0

sctp Not Available Not Available 0 0 0

decryption Not Available Not Available 0 0 0

config 2023/09/28 15:30:32 2023/10/10 12:35:03 7282416426768400418 0 30

system 2023/09/26 12:29:29 2023/10/10 13:11:04 7282416426768418259 0 79773

globalprotect Not Available Not Available 0 0 0

admin@PA-VM>

Re: Unable to get log forwarding to work

PavelK — Tue, 10 Oct 2023 22:16:45 GMT

Hello @RRussellSplunk

thanks for post!

Could you confirm whether logs are received by log collector by this command in Panorama: show logging-status device <FW SN> ?

Also, check that Firewall and Panorama have the same time/time zone. KB for reference.

Kind Regards

Pavel

Re: Unable to get log forwarding to work

RRussellSplunk — Thu, 12 Oct 2023 18:15:31 GMT

admin@Panorama> show logging-status device NNNNNNNNNNNNNN

Type Last Log Rcvd Last Seq Num Rcvd Last Log Generated

Source IP : 3

Destination IP : 10.1.16.190

Source Daemon : logrcvr

Connection Id : 007951000393837-log-collection-lr-10.1.16.190-3-def

Log rate: 0

config N/A N/A N/A

system N/A N/A N/A

threat N/A N/A N/A

traffic N/A N/A N/A

hipmatch N/A N/A N/A

gtp-tunnel N/A N/A N/A

userid N/A N/A N/A

iptag N/A N/A N/A

auth N/A N/A N/A

sctp N/A N/A N/A

decryption N/A N/A N/A

globalprotect N/A N/A N/A

Source IP : 4

Destination IP : 10.1.16.190

Source Daemon : logrcvr

Connection Id : 007951000393837-log-collection-lr-10.1.16.190-4-def

Log rate: 0

config N/A N/A N/A

system N/A N/A N/A

threat N/A N/A N/A

traffic N/A N/A N/A

hipmatch N/A N/A N/A

gtp-tunnel N/A N/A N/A

userid N/A N/A N/A

iptag N/A N/A N/A

auth N/A N/A N/A

sctp N/A N/A N/A

decryption N/A N/A N/A

globalprotect N/A N/A N/A

Source IP : 2

Destination IP : 10.1.16.190

Source Daemon : logrcvr

Connection Id : 007951000393837-log-collection-lr-10.1.16.190-2-def

Log rate: 0

config N/A N/A N/A

system N/A N/A N/A

threat N/A N/A N/A

traffic N/A N/A N/A

hipmatch N/A N/A N/A

gtp-tunnel N/A N/A N/A

userid N/A N/A N/A

iptag N/A N/A N/A

auth N/A N/A N/A

sctp N/A N/A N/A

decryption N/A N/A N/A

globalprotect N/A N/A N/A

Source IP : Default

Destination IP : 10.1.16.190

Source Daemon : logrcvr

Connection Id : 007951000393837-log-collection-lr-10.1.16.190-def

Log rate: 0

config N/A N/A N/A

system N/A N/A N/A

threat N/A N/A N/A

traffic N/A N/A N/A

hipmatch N/A N/A N/A

gtp-tunnel N/A N/A N/A

userid N/A N/A N/A

iptag N/A N/A N/A

auth N/A N/A N/A

sctp N/A N/A N/A

decryption N/A N/A N/A

globalprotect N/A N/A N/A

Source IP : 1

Destination IP : 10.1.16.190

Source Daemon : logrcvr

Connection Id : 007951000393837-log-collection-lr-10.1.16.190-1-def

Log rate: 0

config N/A N/A N/A

system N/A N/A N/A

threat N/A N/A N/A

traffic N/A N/A N/A

hipmatch N/A N/A N/A

gtp-tunnel N/A N/A N/A

userid N/A N/A N/A

iptag N/A N/A N/A

auth N/A N/A N/A

sctp N/A N/A N/A

decryption N/A N/A N/A

globalprotect N/A N/A N/A

Source IP : Default

Destination IP : Default

Source Daemon : unknown

Connection Id : 007951000393837

Log rate: 0

config N/A N/A N/A

system N/A N/A N/A

threat N/A N/A N/A

traffic N/A N/A N/A

hipmatch N/A N/A N/A

gtp-tunnel N/A N/A N/A

userid N/A N/A N/A

iptag N/A N/A N/A

auth N/A N/A N/A

sctp N/A N/A N/A

decryption N/A N/A N/A

globalprotect N/A N/A N/A

admin@Panorama>

Re: Unable to get log forwarding to work

RRussellSplunk — Thu, 12 Oct 2023 18:17:42 GMT

The GUI shows both are set to timezone US/Pacific

Re: Unable to get log forwarding to work

PavelK — Fri, 13 Oct 2023 01:25:26 GMT

Hello @RRussellSplunk

thank you for reply.

From output you provided, it looks like Panorama is not getting logs. Could you please run this command on Firewall: show log-collector preference-list ? If the output of this command does not return log collector's IP address, then could you restart management process on Firewall?

Also make sure that on Panorama side all changes are committed and pushed to log collector group.

Further details are described in this KB: Firewall not sending logs to correct log collector.

Kind Regards

Pavel

Re: Unable to get log forwarding to work

RRussellSplunk — Mon, 16 Oct 2023 19:17:37 GMT

Output of command:

admin@PA-VM> show log-collector preference-list

Log Collector Preference List

Forward to all: No

Serial Number: 000710015859 IP Address: 10.1.16.190 IPV6 Address: unknown

Tried a reboot of the firewall, and the output of that command is the same after the reboot.

Logs still do not appear to be making it to Panorama after the reboot.

Reading through the KB you sent. Will report back.