Unsynchronization in the log display in paloalto FW

Alpalo — Fri, 03 Dec 2021 08:18:01 GMT

The hours in which events appear in the Paloalto log do not correspond to reality. They appear several hours after they have occurred.
We have checked that it is not a problem with the NTP, this seems to be a problem with the time at which Paloalto shows the sessions.
Does anyone know what could be the cause of this delay?

Re: Unsynchronization in the log display in paloalto FW

aleksandar.astardzhiev — Fri, 03 Dec 2021 09:03:27 GMT

Hi @Alpalo ,

- Let begin with something simple - What timezone are you using and what timezone is the firewall configured?

- You mentioned you have checked the NTP, but have you confirm FW can reach the NTP? Under CLI run "show ntp" and status should say "synched"

- It is important to note, how the firewall is configured to log the traffic. Is it at the end of the session, at the start or both. This setting is configured separately for each rule and by default it is set to log at session end. This means that if you have long life sessions, you will not see any log event until the session is closed. Even if session is running for days, you will see log entry only when the session is closed.

- It is important also to note, that each traffic log entry has three timestamps recorded: actuall session start, actuall session end, and log genered time. If you check the "start time", does it correspond to the time you expect to see?

topic Re: Unsynchronization in the log display in paloalto FW in General Topics

Unsynchronization in the log display in paloalto FW

Re: Unsynchronization in the log display in paloalto FW