topic Re: Last shutdown/restart date in General Topics

Last shutdown/restart date

BehzadTalsoleman — Thu, 01 Mar 2018 01:17:24 GMT

Is there anyway to find out when a device was last shutdown?

Thanks,

Remo — Thu, 01 Mar 2018 06:15:13 GMT

There is an uptime value. Maybe this value helps in your situation.

--> Now - uptime = starttime of the firewall

But if the firewall was restarted then or if it simply was powered on you need to search in the systemlogs.

reaper — Thu, 01 Mar 2018 08:55:05 GMT

you can also look for eventid system-shutdown in the system log

( eventid eq system-shutdown )

BehzadTalsoleman — Thu, 01 Mar 2018 18:45:22 GMT

just out of curosity, is there an official cheatsheet where you found this on?

reaper — Fri, 02 Mar 2018 12:29:52 GMT

years and years of experience 😉

I do take requests, If you'd like some things documented 🙂

BehzadTalsoleman — Fri, 02 Mar 2018 16:52:29 GMT

I wish Palo had a cheatsheet for these useful commands.

theonewhoknocks — Mon, 05 Mar 2018 09:58:03 GMT

Hi Reaper,

Do you have a list? Or is there a documentation? For the list of "event types" on system logs.

I only know the basics like, ha/vpn/system-shutdown.

reaper — Mon, 05 Mar 2018 10:14:25 GMT

the query builder will help you with that kind of information:

so the list of 'types' in system log, at time of writing for PAN-OS 8.0 is:

theonewhoknocks — Mon, 05 Mar 2018 10:36:08 GMT

I never really used the query builder. Will try to use it more now. Thank you for this! Cheers!