topic Re: No logs in wildfire log section on device- PAN OS 5.0.3 in General Topics

No logs in wildfire log section on device- PAN OS 5.0.3

Gururaj — Wed, 17 Jul 2013 11:39:32 GMT

Hi ,

Even we have the valid wildfire subscription, not able to see any logs in wildfire logs in device but in the data-filtering logs for some exe files it is showing wildfire-upload-success ( means file has uploaded to wildfire cloud for analysis).

I executed the commands >test wildfire registration - showing registered

>show wildfire status - showing 4 files forwarded

Dynamic updates for wildfire has scheduled for 15 minute.

But still after 3 hours also i am not able to see any (verdict) logs in wildfire logs section on device.

"Is only for verdict"malicius" will be sent to device?

Regards,

Gururaj

Re: No logs in wildfire log section on device- PAN OS 5.0.3

UhMayYeah — Wed, 17 Jul 2013 12:15:34 GMT

By default, only malware logs are delivered to the device.

To turn on receiving reports for benign files:

CLI

#set deviceconfig setting wildfire report-benign-file yes

#commit

Re: No logs in wildfire log section on device- PAN OS 5.0.3

mbutt — Wed, 17 Jul 2013 16:55:55 GMT

Here is some more relevant information regarding Wild fire

https://live.paloaltonetworks.com/docs/DOC-5266

Symptom

When a wildfire-upload-skip message is seen in the data filtering logs, all the files do not appear on the WildFire portal.

Cause

In PAN-OS 5.0, when a file is received by the firewall, a hash is created and checked with the WildFire server. If the hash matches on the WildFire server, the action wildfire-upload-skip is taken. At this point, one of the following occurs based on the categorization of the file:

If the file had been previously determined to be malicious, then the report, previously generated when the verdict was made, appears on the WildFire server.
If the file was not malicious and was determined to be benign, then the report is not shown on the WildFire server.

Thanks

Re: No logs in wildfire log section on device- PAN OS 5.0.3

Gururaj — Thu, 18 Jul 2013 04:43:15 GMT

Thank you Nadir 🙂