topic Re: Cannot find pan_packet_diag.log on PA VM in General Topics

Cannot find pan_packet_diag.log on PA VM

HAL9000 — Thu, 04 Aug 2016 09:26:38 GMT

Hello,

I am new to this forum so please bear with me. I would like to use debug log feature on my PA VM. I am able to turn the logging on with the following commands:

debug dataplane packet-diag set log

debug dataplane packet-diag set log feature flow basic

But I am unable to localize the pan_packet_diag.log file to view the logs. dp0-log does not exist on PA VM. And it is not under mp-log either.

Also, I would like to know if there is debug command which will show me on which interface the packet was received and transmitted. Packet capture does not provide such information.

Thank you.

Re: Cannot find pan_packet_diag.log on PA VM

TranceforLife — Thu, 04 Aug 2016 11:08:21 GMT

Hi,

Is it licensed VM?

Re: Cannot find pan_packet_diag.log on PA VM

HAL9000 — Thu, 04 Aug 2016 11:18:33 GMT

Hi,

Yes, it is licensed.

Re: Cannot find pan_packet_diag.log on PA VM

TranceforLife — Thu, 04 Aug 2016 11:35:35 GMT

Debug Dataplane Changes

1. On PA-200 all debug logs are now stored in the file pan_task_1.log. To view debug logs use the command “tail

follow yes mp-log pan_task_1.log” or “less mp-log pan_task_1.log”2. In PAN-OS 5.0 and later, you can run a command to aggregate the dataplane logs into one log file. After the debuglogs have been collected, disable the flow basic debug and then run the following command: debug dataplanepacket-diag aggregate-logs.This command will result in all dataplane logs to be aggregated to packet-diag. This is helpful on PA-5000 Serieswhere there are multiple dataplanes. You can then view the aggregated logs collected from all of the dataplanes inone single file.

Example of enabling debug log in PAN-OS 5.0 is shown below:

debug dataplane packet-diag clear log logdebug dataplane packet-diag set filter match source 172.16.100.87 destination172.16.101.100 destination-port 21 protocol 6debug dataplane packet-diag set filter ondebug dataplane packet-diag set log feature flow basicdebug dataplane packet-diag set log on

To aggregate the dataplane logs, disable the debug logs and then wait about a minute to allow the logs to be fullywritten and then run: debug dataplane packet-diag aggregate-logs. This will combine the dataplanelogs into a single file named single pan_packet_diag.log file.

Re: Cannot find pan_packet_diag.log on PA VM

TranceforLife — Thu, 04 Aug 2016 11:33:22 GMT

Useful links:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Aggregate-Flow-Basic-or-Other-Dataplane-quot-packet-diag/ta-p/55345