topic Re: syslog no log sometimes in General Topics

syslog no log sometimes

Retired Member — Fri, 05 Jul 2013 06:57:57 GMT

Hi,

Pa200 configured to send all to syslog.Sometimes(Random) no log comes to syslog.Did Anyone see an issue like this ?

5.0.5 panos.

Re: syslog no log sometimes

UhMayYeah — Fri, 05 Jul 2013 08:06:38 GMT

On firewall that is not forwarding the logs run the following command to verify forwarding :

>show log system direction equal backward query equal "(actionflags has fwd)"

Is the issue related to Syslog server or Panorama?

Not aware of any forwarding related issues on 5.0.5

Re: syslog no log sometimes

Retired Member — Fri, 05 Jul 2013 09:46:28 GMT

I will try that.No panorama.

I changed service route for syslog to LAN interface(syslog server sama subnet with LAN and also management ip subnet) and write a app override rule also to see if anything changes.I see logs from trust to trust but they are seperated.For example a log comes with 1.1 M and after 10 minutes another log comes with different size...but still on syslog server we don't see logs for that time.

Re: syslog no log sometimes

Retired Member — Fri, 05 Jul 2013 10:58:44 GMT

show log system direction equal backward query equal "(actionflags has fwd)"

Nothing comes with this

Re: syslog no log sometimes

UhMayYeah — Fri, 05 Jul 2013 11:08:36 GMT

Can you verify if the config is correct:

https://live.paloaltonetworks.com/docs/DOC-3836

Re: syslog no log sometimes

Retired Member — Fri, 05 Jul 2013 11:18:43 GMT

yes all the same.

Re: syslog no log sometimes

UhMayYeah — Fri, 05 Jul 2013 22:08:19 GMT

I would suggest opening a case with support for intrusive MP-based troubleshooting.