topic Re: Moving/importing logs after HD failure in General Topics

Moving/importing logs after HD failure

darren_g — Mon, 07 Jul 2014 05:36:13 GMT

Hi.

Recently, owing to an unplanned abrupt shutdown of my active firewall, I ended up with a hard drive corruption which prevented it from booting up (thank $deity for HA pairs).

Quite apart from PA's *ridiculously* bad response time to replace the hard drive (which is being/will be discussed with my support partner, trust me), I need to know if anyone knows how I can get the logs from the old drive onto the new one?

I spent about 4 hours copying them before I installed the new drive - and the first thing the damn thing did on bootup was erase the private data - including the logs I had painstakingly copied to the device.

So - does anyone know if I can get the log files *back* onto the device before I kick it back into "active" mode? Or do I need to shut it down now that it's got all its config and stuff back on it, then copy the files back from the old drive again and put the new one back into service? I can recover all but one day of the old logs - and give that there's almost 12 months of log data on the old drive, I'm loathe to lose it if I can avoid it.

Thanks for any input.

Re: Moving/importing logs after HD failure

HULK — Mon, 07 Jul 2014 05:48:57 GMT

Hello Darren,

Which Platform it is...? In PAN-5000 platform with RAID enabled, can recover old logs from the HDD.

Thanks

Re: Moving/importing logs after HD failure

darren_g — Mon, 07 Jul 2014 05:52:10 GMT

PA2000.

I can get (have got) the old data - I just don't see any method (FTP, SCP etc) to put it back on the new drive bar pulling it out and using an external drive cradle.

Re: Moving/importing logs after HD failure

hshah — Mon, 07 Jul 2014 05:53:42 GMT

You may want to approach PAN TAC, see if they can move data from root via SCP.

Re: Moving/importing logs after HD failure

HULK — Mon, 07 Jul 2014 06:00:45 GMT

Hello Darren,

This DOC may help you to import Logs into PAN FW.

CLI Commands to Export/Import Configuration and Log Files

Else, PAN support engineer would be able to copy the logdb file into the proper directory.

Thanks

Re: Moving/importing logs after HD failure

hshah — Mon, 07 Jul 2014 06:03:29 GMT

Hi Darren,

IF HDD is corrupt, then how did you login to firewall now ? Based on answer solution will vary.

Regards,

Hardik Shah

Re: Moving/importing logs after HD failure

darren_g — Mon, 07 Jul 2014 21:59:46 GMT

HULK wrote:

Hello Darren,

This DOC may help you to import Logs into PAN FW.
CLI Commands to Export/Import Configuration and Log Files

Else, PAN support engineer would be able to copy the logdb file into the proper directory.

Thanks

Thanks - those might help - I'm experimenting now to see how I can make this work.

Re: Moving/importing logs after HD failure

darren_g — Mon, 07 Jul 2014 22:00:28 GMT

hshah wrote:

Hi Darren,

IF HDD is corrupt, then how did you login to firewall now ? Based on answer solution will vary.

Regards,

Hardik Shah

It's been replaced, and the device put back online (as the passive node in the cluster). I'm trying to put the old logs back before I put it back into active mode.

Re: Moving/importing logs after HD failure

hshah — Tue, 08 Jul 2014 00:40:34 GMT

Hi Darren,

I am not sure if this idea would work, but worth trying.

connect faulty HDD to linux box, now SCP its log to SCP server.

Now, re-SCP it to newer HDD partition. For this you might need TAC help, as you do not have root access.

Regards,

Hardik Shah

Re: Moving/importing logs after HD failure

darren_g — Tue, 08 Jul 2014 00:45:12 GMT

hshah wrote:

Hi Darren,

I am not sure if this idea would work, but worth trying.

connect faulty HDD to linux box, now SCP its log to SCP server.

Now, re-SCP it to newer HDD partition. For this you might need TAC help, as you do not have root access.

Regards,

Hardik Shah

Hardik.

I am working on something quite similar.

I am currently moving the logdb directory (what I can get of it, which is most) from the failed hard drive to a Linux server.

Once I have moved this data, I will create an archive in the correct format (gzipped tar) and see if I can SCP it back to the repaired firewall unit using the commands in the documents Hulk showed above.

If it works, it's an exercise in frustration - Palo Alto should make this so much easier - but if I manage to get the majority of my data back, I'm happy with that.

Re: Moving/importing logs after HD failure

hshah — Tue, 08 Jul 2014 01:09:55 GMT

Hi Darren,

Right now there is no set process to recover logs from faulty disk. Approach your Sales Engineer, he can raise a Feature Request, after that we may have a set procedure for this.

Regards,

Hardik Shah