topic Re: Log Forwarding to Panorama Not Working in Panorama Discussions

Log Forwarding to Panorama Not Working

Cyclones92 — Thu, 29 Mar 2018 13:13:01 GMT

So apparently I must be missing something. I configured Log Forwarding to send it to my Panorama instance, so that when I click on Monitor I can click and view the logs but apparently none of my logs are showing up in Panorama. They show up find on the firewalls but not in Panorama.

I have made sure that all my Log Forwarding profiles have it checked to send to Panorama. The device setup shows it's connected to the correct IP address for the Panorama. I thought that was the two main steps you had to be (besides commiting) but I went ahead and even tried to add it to the Zones for the log setting. I also made sure it was set up in the Policies > Security as well for the events that are getting tripped. I am still not seeing any logs in Panorama.

Is there something else I should try or am I missing something?

Re: Log Forwarding to Panorama Not Working

JoeAndreini — Thu, 29 Mar 2018 13:38:27 GMT

For policies, make sure they have a Log Forwarding profile that specifies that sort of traffic be forwarded to panorama

System, Config, HIP, and Correlation logs should be set to forward to panorama under Device -> Log Settings

I have seen instances where the logs do not display in Panorama even though they are forwarded, in this case restarting the configd and management-server processes on panorama fixed it.

Re: Log Forwarding to Panorama Not Working

Cyclones92 — Thu, 29 Mar 2018 13:57:27 GMT

Thanks for the reply! I think I am seeing everything under ACC but not under the Monitor tab. I made those changes you suggested. I guess I will wait or restart the services. Those have to be done through CLI, correct?

Re: Log Forwarding to Panorama Not Working

JoeAndreini — Thu, 29 Mar 2018 15:06:11 GMT

Yes, the service restarts would be done via CLI, but if you did not have the forwarding profiles with "Panorama" checked for traffic that would explain why they were not being forwarded.

I assume this was already the case, but policies must be set to log on session start or end in addition to having a forwarding profile. Without that they will, of course, log neither locally or to panorama.

Before restarting the services, there are additional troubleshooting steps you can take, again from the CLI

On the firewall you can verify log forwarding is configured and active:

>show log-collector preference-list

You should see your panorama appliance serial and IP in the configured list

and

> show logging-status

The output should show a message stating that the log forwarding agent is active

In panorama, you can verify it is recieving the logs

> show logging-status device <firewall serial number>

If it does not indicate current logs, you can have panorama instruct the firewall to restart log forwarding from teh lack acknowledged message:

> request log-fwd-ctrl device <firewall serial number> action start-from-lastack

That generally "fixes" issues where logs are not beign sent at all.

Here are a few articles on the subject in the KB

https://live.paloaltonetworks.com/t5/Configuration-Articles/Palo-Alto-Networks-Firewall-not-Forwarding-Logs-to-Panorama-VM/ta-p/59799

If you mentioned version numbers I missed it.. this is 8.0 but the process is the same in 7.1

https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/manage-log-collection/verify-log-forwarding-to-panorama.html

Re: Log Forwarding to Panorama Not Working

Cyclones92 — Thu, 29 Mar 2018 18:42:42 GMT

So I definitely don't think somethings right. I get the following when I run the command.

Log collector Preference List does not exist

Re: Log Forwarding to Panorama Not Working

JoeAndreini — Fri, 30 Mar 2018 11:24:53 GMT

I have log collectors, so do not know if that is expected when forwarding directly to Panorama. I can check that out in my lab tonight.

Did you check the logging-status on teh device and in panorama? if not, check them anyway, they may give more information.

Re: Log Forwarding to Panorama Not Working

Cyclones92 — Fri, 30 Mar 2018 12:24:23 GMT

So all the Log Forwarding was set to send it to a Splunk instance, which they say is working, but the log forwarding doesn't seem to send to Panorama. I verfied all the checkboxes were set properly but I am at a loss.

Re: Log Forwarding to Panorama Not Working

Cyclones92 — Fri, 30 Mar 2018 12:30:22 GMT

Alright so this is from one of my firewalls that I have verified that everything is checked. I even checked a working instance as well and they all seem to match up well.

The one is the firewall and the other the panorama.

Re: Log Forwarding to Panorama Not Working

Cyclones92 — Tue, 03 Apr 2018 12:22:41 GMT

Any suggestions? 😄

Re: Log Forwarding to Panorama Not Working

SanjaySehgal — Tue, 08 Jun 2021 08:37:18 GMT

I am facing the same issue. No output when running "show logging-status" and show log-collector preference list". log forwarding is configured to forward logs to Panorama.

Re: Log Forwarding to Panorama Not Working

SanjaySehgal — Tue, 08 Jun 2021 08:37:49 GMT

please suggest troubleshooting steps.

Re: Log Forwarding to Panorama Not Working

YEmreSeven — Thu, 24 Mar 2022 13:34:53 GMT

I faced the same issue today. Remove-Commit-Add-Commit Panorama IP from Panorama Settings work for me.