Panorama days behimd on receiving logs

tazzvon — Thu, 15 Sep 2022 06:47:28 GMT

My panorama, based on the spyglass on the monitor tab, shows the logs from the palo altos to be received days after the palo alto recorded them. Cannot find a reason or a fix. Have tried restarting both but problem persists.

Re: Panorama days behimd on receiving logs

kiwi — Thu, 15 Sep 2022 08:40:06 GMT

Hi @tazzvon ,

Which PAN-OS versions are you running on both ?

Are they in the same location ?

Network bandwith can be the reason for this delay.

I'd verify the connection between the firewall and the log collector (panorama). Are there any delays ?

Also check the values in the mp-monitor logs on the firewall/panorama. Search for netstat as shown in the example below and make sure to check the connection between the firewall IP and the panorama IP:

ON THE FIREWALL 2022-09-14 10:41:37.128 +0200 --- netstat tcp 0 671872 10.226.85.43:41159 10.22.171.202:3978 ESTABLISHED 19162/mgmtsrvr ON THE PANORAMA tcp6 0 0 10.22.171.202:3978 10.226.85.43:56651 ESTABLISHED 6473/mgmtsrvr

The 2 numbers next to tcp are receive-queue and send-queue. Notice in the example above the firewall has a send queue of 671872. If the queue number is high then the firewall was unable to send logs to the panorama on time.

Best,

-Kiwi.

topic Re: Panorama days behimd on receiving logs in General Topics

Panorama days behimd on receiving logs

Re: Panorama days behimd on receiving logs