topic Re: Alert from AIOPs that one of our Log Collectors has left the Collector Group in Panorama. in General Topics

Alert from AIOPs that one of our Log Collectors has left the Collector Group in Panorama.

Fariq_Zaidi — Thu, 30 Jan 2025 09:57:40 GMT

I got an alert from AIOPs that one of our Log Collectors has left the Collector Group in Panorama. But after we checked in Panorama both Log Collectors are still in the Collector Group.
1. Why does the alert from AIOPs state that one of the Log Collectors is disconnected?
2. is it because of configure in a non-redundant mode? if so, this config has been existing for a long time but why did the alert just appear?

any good explanation or how to check or troubleshoot this kind of alert

thank you

Re: Alert from AIOPs that one of our Log Collectors has left the Collector Group in Panorama.

BPry — Fri, 31 Jan 2025 01:52:33 GMT

@Fariq_Zaidi,

Have you verified that it didn't drop from the collector group through the logs in Panorama? I would validate that it isn't just a stale alert and that you didn't actually have one drop momentarily.

Re: Alert from AIOPs that one of our Log Collectors has left the Collector Group in Panorama.

Fariq_Zaidi — Fri, 31 Jan 2025 02:21:29 GMT

i got alert from Aiops as below, then verify through panorama according the KB to resolve it, https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMTcCAO, but when we check in Panorama, there is no disconnect or sync status

only informational logs showing "inter-lc additional/data agent on (S/N log collector) -inter lc-d connected" multiple time

so not sure why this happen and how to check further.

any information much appreciated