topic Re: Export traffic logs in CSV in General Topics

Export traffic logs in CSV

Jafar_Hussain — Mon, 09 Dec 2019 07:28:12 GMT

Hello All,

I have tried to export logs from firewall its reach limit up to 1048576 rows, this is only for 3hr logs can anyone have the option to filter logs or can we exceed this limit.?

Re: Export traffic logs in CSV

kiwi — Mon, 09 Dec 2019 09:49:57 GMT

Hi @Jafar_Hussain ,

Each log has a filter area that allows you to set a criteria for which log entries to display :

1048576 is the maximum number of lines.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/monitoring/view-and-manage-logs/filter-logs

Cheers !

-Kiwi.

Re: Export traffic logs in CSV

Jafar_Hussain — Mon, 09 Dec 2019 09:58:36 GMT

@kiwi

I have checked but, I want to export all the logs without filter it is showing millions of flogs for 3-4 hr is there any way to exceed the limits of CSV rows.

I have already exceed limit up to 1048576.

Re: Export traffic logs in CSV

supportoasis — Mon, 09 Dec 2019 10:20:06 GMT

You should use ftp or scp

I would recommend doing FTP.

Export logs to a SCP or FTP server

Run the following commands to export log files:

SCP
> scp export log traffic start-time equal 2011/12/21@12:00:00 end-time equal 2011/12/26@12:00:00 to <value> Destination (username:password@host) or (username@host)
FTP
> ftp export log traffic start-time equal 2011/12/21@12:00:00 end-time equal 2011/12/26@12:00:00 to <value> Destination (username:password@host) or (username@host)

note: 'start-time' and 'end-time' are mandatory values when exporting from the CL

Re: Export traffic logs in CSV

Jafar_Hussain — Mon, 09 Dec 2019 10:41:11 GMT

@kiwi

Thanks for the information, is there any limitation to upgrade logs by this process.

Re: Export traffic logs in CSV

kiwi — Mon, 09 Dec 2019 11:18:53 GMT

Hi @Jafar_Hussain ,

Using ftp or scp to export your logs will have the same limitation.

I would consider using an external syslog server.

Cheers !

-Kiwi.

Re: Export traffic logs in CSV

Jafar_Hussain — Mon, 09 Dec 2019 11:22:10 GMT

@kiwi

Ok, thanks for your support.