topic Re: Logging - 5450 in General Topics

Logging - 5450

clewis1 — Thu, 14 Dec 2023 17:06:23 GMT

Any tips/places to look into when not seeing logs locally on the firewall? new install, PAN OS 10.2.7

Re: Logging - 5450

PavelK — Fri, 15 Dec 2023 09:39:23 GMT

could you check this KB: PA 5400 - No logs seen on the firewall including Traffic, URL filtering, Threat logs etc to see you are facing the same issue?

Kind Regards

Pavel

Re: Logging - 5450

clewis1 — Mon, 18 Dec 2023 17:57:21 GMT

Thank you for the reply, we had seen this article too. Unfortunately this is not the fix for us. Still no logs.

Re: Logging - 5450

PavelK — Mon, 18 Dec 2023 22:59:53 GMT

Hello @clewis1

thank you for reply.

Could you please confirm what logs you are not seeing? All logs including system logs or only traffic logs?

Kind Regards

Pavel

Re: Logging - 5450

clewis1 — Mon, 18 Dec 2023 23:43:56 GMT

Not seeing Threat, Traffic, or URL.

System and config are there

Re: Logging - 5450

PavelK — Tue, 19 Dec 2023 01:14:45 GMT

Hello @clewis1

thank you for reply.

For Traffic and Threat logs could you make sure that all policies have logging enabled: Session Log Best Practices. Also note that you have to override setting for default policies: How to See Traffic from Default Security Policies in Traffic Logs.

For URL logs, you have to set action to alert to see logs: URL Filtering Profiles.

Kind Regards

Pavel

Re: Logging - 5450

clewis1 — Mon, 22 Jan 2024 14:50:35 GMT

Hardware startup guide was missing a step.

>request logdb-migrate logging-drive start

This command will do the following
-will migrate from system drive to logging drive
-remove setting/management/quota-settings/disk-quota from running-config.xml and templates
-update configuration schema to switch from disk-quota (single-disk) to chassis-quota (multi-disk)
-reboot the FW so the updated configuration schema will take effect.

After running this, we now have logs