https://live.paloaltonetworks.com/t5/general-topics/gp-always-on-disconnect-with-comment-logs/m-p/531300#M109569 <P>Under GlobalProtect logs look at the gateway-agent-msg events. Since this also includes a bunch of nsupdate events, use the query below.</P> <P>( eventid eq gateway-agent-msg ) and ( opaque contains 'Agent Disable' )</P> Wed, 15 Feb 2023 20:44:27 GMT BPry 2023-02-15T20:44:27Z https://live.paloaltonetworks.com/t5/general-topics/gp-always-on-disconnect-with-comment-logs/m-p/531296#M109568 <P>Am I just blind or where do the GP disconnect comments get logged to?</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Claw4609_0-1676493372844.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/47984i2D4B7DDC620E5598/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="Claw4609_0-1676493372844.png" alt="Claw4609_0-1676493372844.png" /></span></P> <P>&nbsp;</P> Wed, 15 Feb 2023 20:37:30 GMT https://live.paloaltonetworks.com/t5/general-topics/gp-always-on-disconnect-with-comment-logs/m-p/531296#M109568 Claw4609 2023-02-15T20:37:30Z https://live.paloaltonetworks.com/t5/general-topics/gp-always-on-disconnect-with-comment-logs/m-p/531300#M109569 <P>Under GlobalProtect logs look at the gateway-agent-msg events. Since this also includes a bunch of nsupdate events, use the query below.</P> <P>( eventid eq gateway-agent-msg ) and ( opaque contains 'Agent Disable' )</P> Wed, 15 Feb 2023 20:44:27 GMT https://live.paloaltonetworks.com/t5/general-topics/gp-always-on-disconnect-with-comment-logs/m-p/531300#M109569 BPry 2023-02-15T20:44:27Z https://live.paloaltonetworks.com/t5/general-topics/gp-always-on-disconnect-with-comment-logs/m-p/531305#M109570 <P>Ah so just blind, got it. Thank you.</P> Wed, 15 Feb 2023 21:14:45 GMT https://live.paloaltonetworks.com/t5/general-topics/gp-always-on-disconnect-with-comment-logs/m-p/531305#M109570 Claw4609 2023-02-15T21:14:45Z