topic Re: WildFire Submission no logs in General Topics

WildFire Submissions no logs

TranceforLife — Tue, 24 Jan 2017 16:25:19 GMT

Hi All,

PA-3050 PAN-OS 7.1.6

While checking WildFire configuration l have noticed strange thing where no logs display on the WildFire Submission or Data Filtering tab:

When l test with the KB article below can observe that the test file is sent to the portal and verdict is assigned:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Test-WildFire-with-a-Fake-Malicious-File/ta-p/60925

Had exactly the same on our lab firewall where no logs were seen and files are sent to the portal same as file blocking profiles didn't work. I did reboot the box and the issue is gone but l cannot do the same with this one. Any ideas on how to fix this?

CLI for WildFire status and statistics looks good to me:

Thx,

Myky

Re: WildFire Submission no logs

bmorris1 — Tue, 24 Jan 2017 10:09:11 GMT

Hi Myky,

Hmm seems a bit odd, have a check on the following things:

- Logging enabled on the security policy

- Quota for wildfire logs has space (Device > Setup > Logging and Reporting Settings)

- Check the status of the processes on the management plane - show system resources (logrcvr/varrcvr)

hope this helps,

Ben

Re: WildFire Submission no logs

TranceforLife — Tue, 24 Jan 2017 10:11:46 GMT

@bmorris1 good points. Will do. For the log space should be fine as it is a new install.

Thx,

Myky

Re: WildFire Submission no logs

TranceforLife — Tue, 24 Jan 2017 16:35:46 GMT

Hi,

The below command did a trick:

> debug software restart process vardata-receiver

Logs are seen now.

Thx,

Myky

Re: WildFire Submission no logs

BPry — Tue, 24 Jan 2017 17:41:58 GMT

@TranceforLife For some reason I didn't see this one when looking through this morning. I'm not sure what you are running this on but this appears to be a pretty common error that I've seen on 3020s where I probably have to restart vardata-receiver at least once a month to get the logs to start showing again.

I've slowly started to work in a restart of the boxes once a month and just switching between the HA pairs for all clients running the 3000 series to get away from this issue. I'm not exactly sure why it ever stops in the first place but since it's easy enough to clear up I never really worry about it.

Re: WildFire Submission no logs

TranceforLife — Tue, 24 Jan 2017 18:55:12 GMT

Hello,

Thanks. This is a fist time l run into this issue. Yes it is 3050 device so looks like l need to remember that command :0 Same not sure why this is happening but happy it is fixed.

Thx,

Myky

Re: WildFire Submissions no logs

Pattarachai — Thu, 15 Feb 2018 02:50:13 GMT

@TranceforLife I would like to know because I found this same issue but It is only some file not to show log if use "debug software restart process vardata-receiver" it work? please suggest me.