topic Re: Data Redistribution Agent - system log message in Panorama Discussions

Data Redistribution Agent - system log message

Richard_M — Wed, 20 Sep 2023 05:08:59 GMT

Hi,
In our Panorama system log I see a lot of logs giving the output shown below:

Event: connect-agent-failure )
Description: 'Redistribution Agent "data redistribution agent id"(vsys1): details: close connection to agent'

I see this messages are coming in from all our firewalls and it started around 18 months ago.

I tried to look through some documents on what the Data Redistribution Agent does and why this entry shows up in the system log but I can`t seem to get it.

Anyone who can answer that or got some ideas why?

Re: Data Redistribution Agent - system log message

akuzhuppilly — Thu, 21 Sep 2023 02:46:44 GMT

Hello @Richard_M

Data Distribution Agents can be Firewall/Panorama or a Windows UID agent. They essentially gather user-IP mapping information from resources like AD. The Firewalls in your network act as clients to retrieve this information from the agents.

For example, in step 7 of the document, it explains how to set up a data distribution agent in a Firewall.

Configure the Windows User-ID Agent for User Mapping

The system logs you discovered typically indicate connectivity problems. To gain a better understanding, perform a packet capture or tcpdump (for the management interface) between the Firewall and the distribution agent. This will provide you with a comprehensive overview.

Re: Data Redistribution Agent - system log message

Richard_M — Thu, 21 Sep 2023 13:15:21 GMT

Hi @akuzhuppilly
Thanks for your reply.
According to the last step (I) in the 7th step in the guide it says

"Verify that the Connected status displays as connected (a green light)."

At the firewall here it says "No" under Connected. How do I exactly make become connected?
For all the other fw`s it says "Yes" under connected.

Regarding that the log indicates connectivity problems. Do you fix that at the firewall or somewhere else?

I see in the same document, step 8 it says something about the user id-agent. Where do you "launch the User-ID agent"

Re: Data Redistribution Agent - system log message

J.Makhoul — Thu, 11 Dec 2025 12:44:45 GMT

Hi,

Did this get solved?
If so, how?

Thanks