topic Re: Problem with system logs in General Topics

Problem with system logs

_slv_ — Fri, 14 Mar 2014 16:48:04 GMT

Hello

I realized that something wrong is with system log. On dashboard I have "No data available." in "System Log" sections.

In Monitor > system log I have a lot of

I did :

debug software restart device-server

debug software restart management-server

This problem occur because yesterday I worked with support engineer. Unfortunetelly we leave packet capture enabled for whole night. Today morning I realized that the pcap files are over 200MB big. I disabled packet capture, deleted pcap files

Please help me.

With regards

Slawek

Re: Problem with system logs

Phoenix — Fri, 14 Mar 2014 17:54:13 GMT

Hello Slv,

How does it look from the CLI,

"show log system direction equal backward"

Also if you trigger some system logs by logging off and logging on to the GUI or SSH we can see if any new logs are being generated.

Try to restart the varrcvr

"debug software restart vardata-receiver"

helps in packet capture process restarts.

Pls let us know.

Re: Problem with system logs

_slv_ — Fri, 14 Mar 2014 20:19:35 GMT

Hi Phoenix

"show log system direction equal backward":

Time	Severity Subtype Object EventID ID Description

===============================================================================

1970/01/01 01:00:00 Unknown general	unknown 0
1970/01/01 01:00:00 Unknown general	unknown 0
1970/01/01 01:00:00 Unknown general	unknown 0
1970/01/01 01:00:00 Unknown general	unknown 0
1970/01/01 01:00:00 Unknown general	unknown 0
1970/01/01 01:00:00 Unknown general	unknown 0
1970/01/01 01:00:00 Unknown general	unknown 0
1970/01/01 01:00:00 Unknown general	unknown 0
2031/05/11 20:14:06 Unknown general	unknown 0
1970/01/01 01:00:00 Unknown general	unknown 0
1970/01/01 01:00:00 Unknown general	unknown 0
1970/01/01 01:00:00 Unknown general	unknown 0
1970/01/01 01:00:00 Unknown general	unknown 0
1970/01/01 01:00:00 Unknown general	unknown 0

I try "debug software restart vardata-receiver" but it doesn't help.

Any ideas?

Re: Problem with system logs

hyadavalli — Fri, 14 Mar 2014 21:17:43 GMT

Hello Slv,

Timestamps doesn't look good in the above logs.

I know there is a known issue related to timestamps and that's the reason why it shows as unknown.

What Os version currently firewall running on?

Regards,

Hari Yadavalli

Re: Problem with system logs

_slv_ — Sat, 15 Mar 2014 06:31:26 GMT

Hi Hari

I'm runing 5.0.9 PAN, timestamps are bad but also in every log entry there isn't information that shold be there.

Only system log is affected, other logs are OK.

Regards

Slawek

Re: Problem with system logs

_slv_ — Sat, 15 Mar 2014 07:17:12 GMT

Today system logs started working.... I dont understand how - but it's started working at 1:00.

Re: Problem with system logs

Retired Member — Sat, 15 Mar 2014 11:24:52 GMT

We saw This issue on a new deployment a few weeks ago.Until I clear all the system and config logs I was unable to see new system and config logs.Maybe if I waited for some period, it would be fixed like as yours.

Re: Problem with system logs

sia2sirtie — Mon, 31 Mar 2014 09:32:03 GMT

Hi,

I am experiencing the same issue, the timestamp jumped sudenly from 1970/01/01 to 1995/08/15 07:31:28.

Over logs are OK.

Not very happy to need erase system logs (no syslog server present).

Is it exist a way to export / clear / import clean logs ?

Re: Problem with system logs

_slv_ — Mon, 31 Mar 2014 11:00:31 GMT

What veriosn of PAN are You using?

Try this:

debug software restart management-server

debug software restart vardata-receiver

debug software restart log-receiver

Regards

Slawek

Re: Problem with system logs

sia2sirtie — Mon, 31 Mar 2014 14:47:29 GMT

Hi,

PANOS 5.08

still same after commands:

Regards.

Re: Problem with system logs

_slv_ — Mon, 31 Mar 2014 14:54:55 GMT

One more thing, when I had this issue I got email from my PA device with topic: "SYSTEM ALERT : critical : "Disk usage exceeds limit, 100 percent in use, cleaning filesystem""

I have email notification for critical system alerts.

Regards

Slawek

Re: Problem with system logs

sia2sirtie — Mon, 31 Mar 2014 15:14:36 GMT

System logs are showing logs from the fist device boot.

I just checked my email but nothing like yours.

I have extended the system logs quota.

Re: Problem with system logs

sia2sirtie — Tue, 01 Apr 2014 10:19:35 GMT

Today logs are OK 🙂