topic Re: Where are the administrator access logs on Panorama? in General Topics

Where are the administrator access logs on Panorama?

PeterT — Tue, 02 May 2017 21:12:37 GMT

In Panorama where are the adminsitrator access logs? I.e. if I want to see when a adminsitrator user last accessed the system. I know where that is on the PA firewalls, but on Panorama??

Re: Where are the administrator access logs on Panorama?

Raido_Rattameister — Wed, 03 May 2017 02:31:10 GMT

You don't see it in system log?

Re: Where are the administrator access logs on Panorama?

reaper — Wed, 03 May 2017 12:33:58 GMT

did you enable system log forwarding ?

Re: Where are the administrator access logs on Panorama?

PeterT — Wed, 03 May 2017 21:06:48 GMT

Raido: LOL I don' t even have that option on my Panorama system (though I do on my PA's):

Re: Where are the administrator access logs on Panorama?

PeterT — Wed, 03 May 2017 21:07:05 GMT

reaper: Yes though I assume it still keeps local logs (as I don' t have access to where the logs are actually forwarded to; don't ask, org politics)

Re: Where are the administrator access logs on Panorama?

reaper — Thu, 04 May 2017 07:37:23 GMT

Hi @PeterT then it would appear your admin account does not have access to these logs (physically or through the GUI)

your only recourse will be to use the context switch to look at the local logs on the firewall

Quis custodiet ipsos custodes 😉

Re: Where are the administrator access logs on Panorama?

PeterT — Thu, 04 May 2017 20:10:43 GMT

@reaper That makes no sense given I'm logged on as the "superuser" on the Panorama 🙂 .. i.e. have rights to everything, I just don't have rights to the Arcsight SIEM where the remote logs are dumped 😉 . I should still be able to see the panorama local access logs though IMHO as would be a wierd situation where the panorama superuser could see the logs on the FW's (which I can) but not panorama itself

Re: Where are the administrator access logs on Panorama?

reaper — Fri, 05 May 2017 07:55:22 GMT

well that's awkward 😛

ehm, what version of PAN-OS are you running? those log files should be there... can you try checking the CLI ?

> show log config direction equal backward
> show log system direction equal backward

Re: Where are the administrator access logs on Panorama?

PeterT — Tue, 09 May 2017 03:22:34 GMT

Panorama 8.0.2

Both work via CLI, the question then (per screenshot above) where is it via the Web UI? I'm thinking possibly bug / call support on this one now lol.

Re: Where are the administrator access logs on Panorama?

reaper — Tue, 09 May 2017 07:18:53 GMT

yeah... if you're superuser those logs should be visible...

one last thing you could try (before calling support) is to 'reset' the gui : https://<panorama IP>/debug

once logged in, click the 'clear preferences' button, this will clear your admin's gui config, in case some flag got set

Re: Where are the administrator access logs on Panorama?

sean.herman@nbexcellence.org — Tue, 09 May 2017 19:20:47 GMT

As a superuser (admin) I also don't see System under logs in Panorama. Running 7.1.9 here. The admin user has it on the NGFWs, just not Panorama.

Re: Where are the administrator access logs on Panorama?

PeterT — Wed, 07 Jun 2017 21:51:05 GMT

Found it in case anybody else ever runs into this. The "Device Grouping" view also changes the left hand menu as well, I didn't realize it was contextual; only though the information displayed on the side was device grouping dependent.

So in my case I needed "All" because Panorama itself isn't a device which can be grouped