topic Re: check all debugging enabled on firewall in General Topics

check all debugging enabled on firewall

aggarwat — Thu, 17 Jun 2021 14:26:13 GMT

I am wondering if there is any way we can check all the enabled debugging on Palo Alto firewall.

Re: check all debugging enabled on firewall

S.Cantwell — Thu, 17 Jun 2021 14:59:52 GMT

Please describe the use case of enabling all debugging. This may degrade efficiency of the firewall, yet I think your query is interesting. Please provide detail/context.

Re: check all debugging enabled on firewall

jdelio — Thu, 17 Jun 2021 15:16:15 GMT

I could not agree more what Steve said.. When you turn on ALL debugging, you run a risk of actually dropping or loosing traffic due to the load that is being placed on the machine/system. And this has even caused outages in the past.. to the point where a lot of the Debugging information has been removed from LIVE, and it is difficult to find it because of that reason.

So, I echo.. tell us what exactly is going on and we may be able to help out.

Re: check all debugging enabled on firewall

aggarwat — Thu, 17 Jun 2021 16:28:59 GMT

Well I don't want to disable ALL debugging. I saw recent increase in CPU and Memory utilization. So I am curious if there is way we can check if there is any type of debugging enabled, something like show debugs

Re: check all debugging enabled on firewall

BPry — Fri, 18 Jun 2021 03:32:57 GMT

@aggarwat,

I don't believe that there's a way to view logging levels at a system level. All of the logging levels that you can adjust will have a 'show' option to display the current log level, but I don't believe there's a "global" way of looking at every single log level.

Re: check all debugging enabled on firewall

anon4all — Sat, 23 Oct 2021 03:31:54 GMT

this is a a somewhat essential feature and lame that its not available. i understand what the OP wants. in cisco-land you can type "no debug all" to disable any trace of debug left by another user or to quickly kill all debugging. additionally, you can type "show debug" to see all levels of debug that are enabled. PAN firewall desperately needs this feature!

Re: check all debugging enabled on firewall

S.Cantwell — Sat, 23 Oct 2021 11:20:31 GMT

Oh, well if that is what they wanted, then they are simply needing this:

debug software logging-level show level service all-services

and to bring the levels back to default

debug software logging-level set level default service all-services

Re: check all debugging enabled on firewall

anon4all — Mon, 25 Oct 2021 16:11:19 GMT

Thx for the tip!
If I turn on 2-3 debugs, can I turn them all off with the second command, without having to know which debugs are turned on?
Or does the turn off command:

debug software logging-level set level default service all-services
only work when every debug is turned on?

Re: check all debugging enabled on firewall

S.Cantwell — Mon, 25 Oct 2021 22:06:04 GMT

@anon4all It was as you suggested... turn on whatever you want and the 2nd command will bring them all back to whatever the default settings are, without knowing which debugs are turned on.

Re: check all debugging enabled on firewall

mhuddleston — Wed, 18 May 2022 17:26:57 GMT

For reference you can run the command below on firewalls.

>debug software logging-level show level service all-services

This will allow yo to see "all-services" and the debug level currently turned on for them.

You can of course look at specific services by running

>debug software logging-level show level service .....AND now hit TAB to get presented the services you can then choose.

To set all to default level run the following

> debug software logging-level set level default service all-services

This does not work on Panorama.

Re: check all debugging enabled on firewall

wmaher — Tue, 07 Mar 2023 07:58:52 GMT

@aggarwat was asking about displaying the running debug similar to "show debug" and disabling all running debug such as "undebug all" it seems that PANOS doesnt have similar commands.
debug software logging-level show level service all-services, seems to display the SERVICE GLOBAL Logging level, but it doesn't show feature specific debugs. For example if we enable this debug "debug ike gateway extranet-ike-gateway on debug" the "debug software logging-level show level service ikemgr" will show level info. But if we enable this debug "debug ike global on debug", "debug software logging-level show level service ikemgr" will show level debug. Is there even a way to verify the status of a specific debug such as "debug ike gateway extranet-ike-gateway"
Regards,

Wafik

Re: check all debugging enabled on firewall

RodO — Thu, 30 Mar 2023 22:40:22 GMT

Any answers here. I have been troubleshooting over the last few months and really want a command that will show me if I have any debugs still active. Panorama and Firewalls.

Re: check all debugging enabled on firewall

skurowski — Wed, 13 Sep 2023 13:29:26 GMT

To show:
>debug software logging-level show level service all-services

To reset all to default:
>debug software logging-level set level default service all-services

Re: check all debugging enabled on firewall

mhuddleston — Wed, 13 Sep 2023 14:15:48 GMT

As when you were running the command initially from the CLI, you can TAB through the options on a specific command sequence. If you were to run >debug ike global ...and then TAB you will see the options below.

admin@Lab_PA-3250> debug ike global
> off ....Turn off ikemgr debug logging
> on ....Turn on ikemgr debug logging
> show ....show ikemgr debug logging

Some commands you will need to validate within the specific command sequence. This can always be validated by using the contextual assistance in the CLI.

Re: check all debugging enabled on firewall

J-Miller — Tue, 19 Dec 2023 21:34:57 GMT

Thank you Mhuddleston! Much appreciated!