topic Re: Log Collector is error after upgrade OS version from 11.0.4-h2 to 11.1.x in Panorama Discussions

Log Collector is error after upgrade OS version from 11.0.4-h2 to 11.1.x

TungDS3 — Tue, 23 Jul 2024 04:16:12 GMT

I have an issue with Log collector ( local on Panorama server) after I upgrade OS version from 11.0.4-h2 to 11.1.2-h3 (and 11.1.2-h4) . The es on Log collector show status as “not running”.

- On active Panorama server:

+ See the Log collector ( local on active Panorama server) with the Health status as Green.

+ See the Log collector ( local on passive Panorama server) with the Health status as Red and es is shown as "not running".

- On passive Panorama server:

+ See the Log collector ( local on passive Panorama server) with the Health status as Green.

+ See the Log collector ( local on active Panorama server) with the Health status as Red and es is shown as "not running".

I have tried to restart elasticsearch and management-server on both 2 Panorama servers but still no luck.

Please help me to find the solution to resolve this issue ! Thanks !

Re: Log Collector is error after upgrade OS version from 11.0.4-h2 to 11.1.x

RodyDeLaRosa — Tue, 15 Oct 2024 17:50:54 GMT

We are affected by the same bug. No resolution from PA yet.

Re: Log Collector is error after upgrade OS version from 11.0.4-h2 to 11.1.x

jmatanane — Thu, 17 Oct 2024 20:02:05 GMT

11.0.4-h2 has been good to us. Just got done dealing with an issue where our 445s were sending duplicate logs to a syslog server with the same has values, timestamps, etc. Upgraded from 11.0.0-h3 to 11.0.4-h2 and the duplicate log issue went away as well as we were able to use radius once again. It's amazing how many bugs are in the OS's. Best of luck on remediating your issue. Have you considered rolling back to 11.0.4-h2?

Re: Log Collector is error after upgrade OS version from 11.0.4-h2 to 11.1.x

RodyDeLaRosa — Fri, 18 Oct 2024 15:57:35 GMT

Something our CISO recommended for me going forward was to avoid any *.0.* version. They are usually the buggiest releases through and through. We unfortunately ran into an Elasticsearch bug going from 11.0.4-h1 to 11.1.4-h2, but it seems to be an issue with 11.0 and not 11.1. I would also recommend rolling-back as jmatanane suggested but be careful to do it during a maintenance window, if you run into the Elasticsearch bug going down to that version you will absolutely need TAC's support to get the logs working again. Tag me here if you run into any problems and I am happy to share insights from our experience getting our environment to stable state again. Good luck.

Re: Log Collector is error after upgrade OS version from 11.0.4-h2 to 11.1.x

Shuvankar — Tue, 25 Mar 2025 06:50:31 GMT

We're encountering the same problem with version 11.1.6-h4, and TAC hasn't been able to provide any solutions yet.

Re: Log Collector is error after upgrade OS version from 11.0.4-h2 to 11.1.x

ozheng — Wed, 26 Mar 2025 09:25:47 GMT

Hello @TungDS3 ,

https://live.paloaltonetworks.com/t5/general-articles/decoding-the-dreaded-quorum-for-logging-with-panorama/ta-p/595202

Time to review the design of the collector deployment.

Olivier