topic Re: After software upgrade firewall stopped to sending syslog in General Topics

After software upgrade firewall stopped to sending syslog

mkukucska — Mon, 31 Mar 2025 14:38:11 GMT

We upgraded PA-1410 from sofware release 11.0.2.-5 to 11.1.6-h3. The upgrade itself went well, but a few days later firewall stopped to send syslog messages. Executed tcpdump on the management port, but there is no syslog traffic at all. Checked the system resources, logrcvr servcie seems to be running. I tried to restart the service, and realize that, after restart two syslog session appeared in the traffic log, but nothig more. After a while, resatarted the service again, and the same happend, two syslog messages and nothing further.

Did anyone face this isse?

Regards,

Mihaly

Re: After software upgrade firewall stopped to sending syslog

MP18 — Mon, 31 Mar 2025 15:33:42 GMT

@mkukucska Never face this issue on PA 1410 running PAN OS 11.1.4-h7.

This is the preferred version.

Re: After software upgrade firewall stopped to sending syslog

mkukucska — Mon, 31 Mar 2025 16:12:18 GMT

@MP18 What do you mean? Based on the doc we are using for choose preferred release, 11.1.6-h3 is the preferred release since 02/27/25.

https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304

Re: After software upgrade firewall stopped to sending syslog

MP18 — Mon, 31 Mar 2025 19:08:02 GMT

@mkukucska Seems 11.1.4-h7 is past preferred release now. You are on Right PAN OS.

Please check this link for Troubleshooting.

How To Troubleshoot Connection Failures To Syslog Servers in PA... - Knowledge Base - Palo Alto Networks

Regards

Re: After software upgrade firewall stopped to sending syslog

BPry — Mon, 31 Mar 2025 21:42:58 GMT

@mkukucska,

You might want to look at PAN-272849 and see if you're impacted by that potentially. You would need to apply 11.1.8 to actually get the fix since you wouldn't be able to apply 11.1.7 on a 1410. Personally I've kept most people off of 11.1 for the time being unless they can thoroughly validate things in a lab environment; I've seen people have better success staying with 10.2 for the time being or actually moving forward to 11.2.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-7-known-and-addressed-issues/pan-os-11-1-7-addressed-issues

Re: After software upgrade firewall stopped to sending syslog

mkukucska — Tue, 01 Apr 2025 08:54:10 GMT

@BPry Our case different, TCP syslog server stopped, even though server is reachable via icpm echo.

Re: After software upgrade firewall stopped to sending syslog

mkukucska — Tue, 01 Apr 2025 11:11:34 GMT

@MP18 Already checked it, but this article is for versions below 11.1

Regards,

Mihaly