topic Re: How does an end-user collect logs from GlobalProtect agent when the advanced view is disabled in General Topics

How does an end-user collect logs from GlobalProtect agent when the advanced view is disabled

DaxVC — Fri, 16 Nov 2018 12:45:38 GMT

I want to collect log files from a GlobalProtect agent 4.1.2 but our gateway policy is set to disable the admin view.

By doing this, the user can't colelct any log files anymore.

Is there another way to collect logs ?

Re: How does an end-user collect logs from GlobalProtect agent when the advanced view is disabled

Mick_Ball — Fri, 16 Nov 2018 13:49:50 GMT

by default the logfiles are located in the install file.

c:\program files\palo alto networks\globalprotect

if you need the pangpa.log then this will be in %homepath%\appdata\local\globalprotect

Re: How does an end-user collect logs from GlobalProtect agent when the advanced view is disabled

DaxVC — Fri, 16 Nov 2018 14:10:43 GMT

Thank you for the response.

These file are usefull indeed, but PA support useally needs the zip file for investigation 🙂

I just wonder if it's possible to only enable the collect logs option in the GlobalProtect agent or if it's possible to genererate the log files using a command

Re: How does an end-user collect logs from GlobalProtect agent when the advanced view is disabled

Mick_Ball — Fri, 16 Nov 2018 14:17:58 GMT

sorry can't answer that one but could you tell me where the setting is to restrict admin view on GP settings.

Re: How does an end-user collect logs from GlobalProtect agent when the advanced view is disabled

DaxVC — Fri, 16 Nov 2018 14:23:59 GMT

On the Palo Alto firewall go to Network/Global Protect/Portal

On the portal config, select the Agent section and open the configured agent

In the configs select the APP section and there is an option to either enable or disable the advanced view

Re: How does an end-user collect logs from GlobalProtect agent when the advanced view is disabled

Mick_Ball — Fri, 16 Nov 2018 14:32:52 GMT

thanks for that, i feel a bit stupid as i was looking for the setting "Admin View".