topic Re: PA-1420 11.0.2-h2 - Monitor - Logs - Traffic - Over 10 minute delay in General Topics

PA-1420 11.0.2-h2 - Monitor - Logs - Traffic - Over 10 minute delay

DeanKorfanty — Fri, 19 Jan 2024 21:20:16 GMT

Trying to look at specific traffic to troubleshoot a connectivity issue and noticed that all Monitor - Logs - Traffic results were 10 minutes or more behind the current time. 2 recently installed PA-1420's in HA. Previous PA-3220 did not have this issue.

Is this expected behavior? System time was 15:12 when screen was grabbed.

Thanks!

Re: PA-1420 11.0.2-h2 - Monitor - Logs - Traffic - Over 10 minute delay

BPry — Fri, 19 Jan 2024 22:40:58 GMT

@DeanKorfanty,

It wouldn't be expected to have any sort of delay from logging present in the traffic logs, those should be nearly instantaneous. I don't have a 1420 to see if this behavior is replicated at all, but it isn't something that I've seen reported by others.

The only time that I've seen this sort of "delay" introduced previously was when someone was messing around with the system time or when there is a system issue. If you've verified that time isn't the issue you can always restart the log-receiver process and the management-server and see if that resolves the issue.

One thing to be mindful of, simply because you don't specify if this is a new install and your logs have a couple second gap between entries, is whether or not you should see any logs if you're just getting this setup. By default entries are only set to log at session close, so if you have limited traffic that is flowing and you're just getting things setup it's possible that you simply don't have any logs to write yet.

Re: PA-1420 11.0.2-h2 - Monitor - Logs - Traffic - Over 10 minute delay

DeanKorfanty — Tue, 30 Jan 2024 15:58:04 GMT

System restart resolved the issue. will check again to see if it reoccurs.