topic Re: Scheduled Log Export Failure in General Topics

Scheduled Log Export Failure

MLaden — Fri, 30 Nov 2012 02:47:48 GMT

I have Scheduled Log Export but it's failing. The system log reads "Failed exporting traffic log via ftp (last-calendar-day)".

If I run the export command via CLI, it runs successfully.

>ftp export log traffic start-time equal 2012/11/28@00:00:00 end-time equal 2012/11/28@23:59:59 to anonymous@hostname

Any ideas on why the Scheduled Log Export is failing?

Thank you,

Monica

Re: Scheduled Log Export Failure

rmonvon — Fri, 30 Nov 2012 19:32:13 GMT

Monica...Please check the setting of the Scheduled Log Export for error(s). You may want to contact Support to open case if you don't see any error(s). Thanks.

Re: Scheduled Log Export Failure

ArkadiuszMatalewski — Mon, 03 Dec 2012 11:44:24 GMT

Have same problem manually i can export all logs w/o problems, but scheduled logs export stopped working after update to a PAN OS 5.0.

Re: Scheduled Log Export Failure

bchaborek — Wed, 18 Dec 2024 15:31:18 GMT

Hello,

I just had the same/similar issue and came across this thread, this was the solution for me:

Environment: Panorama managed Highly Available NGFWs. Scheduled Config Export via SCP working from Panorama, Scheduled Log Export not working from managed NGFWs.

Error: 'Failed exporting traffic log via ssh (last-calendar-day) to <target>

From the firewall CLI a manual SCP works fine:

scp export log traffic to <user>@<target>:/home/logman/palogs/<firewall>-20241218x start-time equal 2024/12/18@07:00:00 end-time equal 2024/09/18@09:00:00
<user>@<target>'s password: <password>
Marking log as exported successfully...

Solution:

From TechNote: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/device/device-scheduled-log-...

"If you use a Panorama template to configure the log export schedule, you must perform this step after committing the template configuration to the firewalls. After the template commit, log in to each firewall, open the log export schedule, and click Test SCP server connection."

I logged on to each individual firewall which had received the configuration from Panorama and executed the Test SCP server connection, which sure enough I had to accept the RSA key of the target ssh server (note: I had already accepted the RSA key using the CLI of each firewall, I didn't realize I also had to do this on the webgui.)

My SSH logs are now exporting properly again. Note that if you have HA firewalls, you will need to do the webgui RSA acceptance on each individual device.

Accept RSA Key on Each Firewall Device