Help needed with pruning ikemgr.log outputs to show only interesting traffic log entries

James_Cook — Thu, 27 Feb 2020 20:06:36 GMT

On Palo Alto CLI the only way I know of to see the logs of VPN tunnel Phase I errors etc is this command from inside the vsys via CLI where the VPN tunnel is built:

less mp-log ikemgr.log

1) Are there commands for CLI where I can show just outputs for ONLY certain tunnel information that I'm seeking from the above log command? I've tried stuff like:

less mp-log ikemgr.log | grep www.xxx.yyy.zzz (Peer IP address)

it returns with 'invalid syntax'

2) Can the entire ikemgr.log be exported? That way I could pull the entire log and then search it for the interesting traffic I'm looking for. But I need the commands for that too.

I am able to see some of the related traffic I want by running the command that's listed above to show the ikemgr log, and then putting in /www.xxx.yyy.zzz after the first page of log results are shown. But that's not exactly what I'm needing. The log file is gigantic and even just going through a single day of the entire log is not possible.

Any help/guidance/suggestions is all appreciated.

Thanks

Re: Help needed with pruning ikemgr.log outputs to show only interesting traffic log entries

BPry — Sun, 01 Mar 2020 05:26:12 GMT

@James_Cook,

There isn't a good way to export that file if this is something that you are doing on a daily basis, also I can't fathom why someone would need to do this on a daily basis.

You can't simply export just this file, but it is included in a technical support file dump; so if you generate a tech-support file you'll be able to export that off of the firewall and then it will contain the ikemgr.log where you can filter it how you like.

Personally I would simply stick to less and build a proper search for what you are looking for. So in the example that you gave you wouldn't actually want to use /www.xxx.yyy.zzz but utilize the search /www[.]xxx[.]yyy[.]zzz instead. Then hit enter to activate the search and you can use 'n' to go to the next result. Maybe that will help make searching through the log in the CLI a bit more usable for you.

topic Re: Help needed with pruning ikemgr.log outputs to show only interesting traffic log entries in General Topics

Help needed with pruning ikemgr.log outputs to show only interesting traffic log entries

Re: Help needed with pruning ikemgr.log outputs to show only interesting traffic log entries