topic Re: Commit not showing who did it in system log in General Topics

Commit not showing who did it in system log

yousef — Thu, 27 Sep 2012 08:10:23 GMT

Dears,

I have a serious issue, yesterday the internet became down suddenly, when i check the firewall, i find out their is big changes happened on the firewall without us knowing, no one have change anything, when i went to the system log to see the commit for which admin, i find the commit is showing without the user?

it should show in this way: Commit job succeeded for user admin

but i find it in the log as: Commit job succeeded

//--------------

2012/09/26 14:50:06info general general 0 Commit job succeeded for user omer

2012/09/26 15:14:52info general general 0 Commit job succeeded

//---------------

and i check the audit version for that commit, and it was a big changes on the policy, even if someone want to do this changes he needs hours...

if someone can tell, What happened? Who? and Why in not telling me which user commit?

Thanks.

Re: Commit not showing who did it in system log

ppatel — Thu, 27 Sep 2012 08:35:50 GMT

Would it be possible to to export the system log between 14:45 and 15:14 and attach it here?

Normally it should say the user who did a commit change on the firewall.

If there is not indication in the system logs, we might have to look into the tech support file of the device.

Which version of software PANOS?

Regards

Parth

Re: Commit not showing who did it in system log

ppatel — Thu, 27 Sep 2012 08:39:15 GMT

On the UI of the firewall Go to Monitor > Logs > Configuration. You should be able to see the user and the changes.

Let me know if this helps

Regards

Parth

Re: Commit not showing who did it in system log

yousef — Thu, 27 Sep 2012 10:39:57 GMT

Hi Parth,

I can't see Configuration under Logs!! our PAN-OS is 4.1.7

Please check the logs between the time you requested...

//------------------------

2012/09/26 14:41:12info general general 0 Commit job succeeded for user omer

2012/09/26 14:42:33info general general 0 User omer accessed Monitor tab

2012/09/26 14:48:39info general general 0 Commit job started, user=omer, command=commit, client type=2, Commit parameters: force=false, device_n

etwork=true, shared_object=true. Commit All Vsys. .

2012/09/26 14:49:19info routing routed- 0 Route daemon configuration load phase-1 succeeded.

2012/09/26 14:49:22info vpn ike-con 0 IKE daemon configuration load phase-1 succeeded.

2012/09/26 14:49:26info ras rasmgr- 0 RASMGR daemon configuration load phase-1 succeeded.

2012/09/26 14:49:43info routing routed- 0 Route daemon configuration load phase-2 succeeded.

2012/09/26 14:49:44info vpn ike-con 0 IKE daemon configuration load phase-2 succeeded.

2012/09/26 14:49:44info ras rasmgr- 0 RASMGR daemon configuration load phase-2 succeeded.

2012/09/26 14:49:45info general general 0 Config installed

2012/09/26 14:49:51high ha config- 0 HA Group 1: Commit on local device with running configuration not synchronized; synchronize manually

2012/09/26 14:49:53info ntpd restart 0 NTP restart synchronization performed

2012/09/26 14:50:06info general general 0 Commit job succeeded for user omer

2012/09/26 14:55:06info general general 0 User omer accessed Monitor tab

2012/09/26 15:12:24info general general 0 synchronized running configuration from HA peer and local candidate configuration

2012/09/26 15:13:12info routing routed- 0 Route daemon configuration load phase-1 succeeded.

2012/09/26 15:13:15info vpn ike-con 0 IKE daemon configuration load phase-1 succeeded.

2012/09/26 15:13:20info ras rasmgr- 0 RASMGR daemon configuration load phase-1 succeeded.

2012/09/26 15:14:17info routing routed- 0 Route daemon configuration load phase-2 succeeded.

2012/09/26 15:14:19info general general 0 Config installed

2012/09/26 15:14:20info vpn ike-con 0 IKE daemon configuration load phase-2 succeeded.

2012/09/26 15:14:20info ras rasmgr- 0 RASMGR daemon configuration load phase-2 succeeded.

2012/09/26 15:14:38info ntpd restart 0 NTP restart synchronization performed

2012/09/26 15:14:52info general general 0 Commit job succeeded

2012/09/26 15:15:52info general general 0 Session for user shoieb via Web from 10.13.2.145 timed out

//-----------------------

Also check this:

2012/09/26 15:12:24info general general 0 synchronized running configuration from HA peer and local candidate configuration

is it related to the commit, and how the Master can get the config from the slave if this log correct.

Thanks

Re: Commit not showing who did it in system log

ppatel — Thu, 27 Sep 2012 10:51:22 GMT

Hi ,

I am surprised that you are not able to see the configuration logs under Monitor Tab.

Can you expand the logs section under Monitor Tab?

Can you check the peer device around 15:12 , as it appears that the config sync was done from the peer's running config.

Regards

Parth

Re: Commit not showing who did it in system log

sdurga — Thu, 27 Sep 2012 17:01:22 GMT

Hi,

"2012/09/26 15:12:24info general general 0 synchronized running configuration from HA peer and local candidate configuration" . Some one did the changes on the passive (or slave) device and committed the config. Since the devices are in HA the passive device pushed the config to the active device. So when this happens the active device will get the config changes from the passive and will commit this changes. So this commit on the active device will not show which user did it. So the message "general 0 Commit job succeeded" is expected. Please go to the passive device and see who did the changes. And also the answer for your question is it possible to push the config changes from the PASSIVE device to ACTIVE device -YES .We can do changes from either side in HA.

Re: Commit not showing who did it in system log

acamacho — Thu, 27 Sep 2012 22:20:07 GMT

Please log on to both HA PA using ssh and execute the following commands:

show jobs all

show jobs all - This sample shows that commit completed with a date and time.

Enqueued ID Type Status Result Completed

--------------------------------------------------------------------------

2012/09/27 14:36:46 5 Commit FIN OK 14:37:02

2012/09/27 11:41:20 4 Commit FIN OK 11:41:37

2012/09/27 11:39:05 3 Commit FIN OK 11:40:00

2012/09/27 11:31:54 2 Commit FIN OK 11:32:51

2012/09/27 11:00:44 1 Commit FIN OK 11:01:00

If there is a commit job for the date/time you are reference or a HA sync.

If you need additional data let us know.

Thanks