topic Re: logdb export very slow then fails in General Topics

logdb export very slow then fails

Gareth — Wed, 09 Jul 2014 13:32:14 GMT

Hi,

I have a PA-500 which is running PAN-OS 5.0.9 and a Panorama server running PAN-OS 5.1. The Panorama is new and I would like to get all the historic traffic logs from the 500 to the Panorama. I have used scp export logdb user@server:logdb to export the logdb off the 500. To begin with the ssh sessions were timing out before the file had finished so I set keep alives to try to get round this issue.

The export ran for about two days and it had appeared to finish. When I try to import the log it gets as far as ./hipmatch/.scheme.500.hipmatch.4.0.5 and stops (see screen shot).

All that happens after this is that the traffic log on the Panorama is empty and it wont accept any new logs from the 500. It's almost like the logdb is corrupt. The exported file was only about 26GB and the settings on the 500 says the logs are set to be 118GB

It seems as if the log export is very slow it only hits about 5mbps at its peak, its connected to gigabit infrastructure.

Has anyone else had a similar issue or know another way to get the logs into the Panorama?

Thanks,

Gareth

Re: logdb export very slow then fails

HULK — Wed, 09 Jul 2014 14:05:40 GMT

Hello Gareth,

Have you tried exporting logs through TFTP export..? Just to check if, through TFTP log-export is working or not.

Thanks

Re: logdb export very slow then fails

Gareth — Wed, 09 Jul 2014 15:00:25 GMT

Hi Hulk,

Thanks for the suggestion, however there doesn't seem to be a corresponding import command for the Panorama.

Gareth

Re: logdb export very slow then fails

HULK — Wed, 09 Jul 2014 15:25:40 GMT

Hello Gareth,

SCP option only works for linux/unix servers. Are you trying to export from PAN firewall to directly Panorama (5.1.x).?

Thanks

Re: logdb export very slow then fails

Gareth — Wed, 09 Jul 2014 15:41:09 GMT

Hi Hulk,

I'm exporting from the 500 to a Linux server then importing from the server to the Panorama.

Thanks,

Gareth

Re: logdb export very slow then fails

HULK — Wed, 09 Jul 2014 15:44:19 GMT

Ok, then it should work smoothly. Is there any intermediate device, which can cause a problem here..?

Thanks

Re: logdb export very slow then fails

Gareth — Wed, 09 Jul 2014 15:48:49 GMT

Traffic between the 500 & panorama and the server does have to pass through a firewall. The ports are open but I guess it could be tearing down the session as its been open for such a long time? I'll try putting a server in the same subnet and see if that makes a difference.

Re: logdb export very slow then fails

pulukas — Thu, 10 Jul 2014 15:19:20 GMT

The default tcp timer is 30 minutes. You could create a custom service on the firewall with a longer timeout value if you think the session keep alive is not working.

Re: logdb export very slow then fails

Gareth — Thu, 17 Jul 2014 14:26:46 GMT

Unfortunately the answer to my question is you cant import the traffic logs from a PA to a Panorama.

Thanks for everyone suggestions.