topic Re: Log to CSV export limits in General Topics

Log to CSV export limits

grenzi — Tue, 14 May 2019 10:24:31 GMT

Hello everybody,

sometimes I'm asked to export some logs from the devices I manage, and most of the time I'm given a well defined time range for the logs to search for. But sometimes I need all the logs matching a particular filter (source, destination, port/application) regardless of the time the logs were generated and, by default, the "export to CSV" is set to return at most 65,535 rows. I know that this limit can be raised up to 1,048,576. Has anyone set this value for the csv export? Is it safe to use this limit or It can have a huge impact on the management subsystem?

Thanks in advance.

Re: Log to CSV export limits

Retired Member — Tue, 14 May 2019 13:13:26 GMT

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaPCAS

Re: Log to CSV export limits

grenzi — Tue, 14 May 2019 13:29:38 GMT

Hi @Retired Member

thanks, I know how to increase that limit. My question was: exporting a 1 million rows CSV file from the UI could impact the device health and the management plane subsystem, i.e. making the WebUI unresponsive?

EDIT: ok, I got it! Thanks

Warning: Increasing the export to the maximum amount, 1048576, may cause management of the device to slow when exporting but will not affect the traffic traversing the firewall.

Re: Log to CSV export limits

Retired Member — Tue, 14 May 2019 13:23:39 GMT

I tried and in my case, answer was yes.