topic Panorama not receiving logs after rebuilding with new OVA in General Topics

Panorama not receiving logs after rebuilding with new OVA

raji_toor — Tue, 19 May 2020 22:03:26 GMT

We had to rebuild Panorama from new OVA file. It is on version 9.0.8 and running on vmware.

Firewalls are all in-sync

This is the disk status on panorama

adm-rajrupindertoor@Panoramanv1> show system disk-space

Filesystem Size Used Avail Use% Mounted on
/dev/root 8.0G 3.4G 4.3G 45% /
none 7.9G 68K 7.9G 1% /dev
/dev/sda5 24G 9.3G 14G 41% /opt/pancfg
/dev/sda6 6.0G 1.8G 4.0G 31% /opt/panrepo
tmpfs 7.9G 110M 7.8G 2% /dev/shm
cgroup_root 7.9G 0 7.9G 0% /cgroup
/dev/sda8 32G 798M 30G 3% /opt/panlogs
/dev/loop0 9.9G 151M 9.2G 2% /opt/logbuffer
/dev/sdb1 1.7T 77M 1.7T 1% /opt/panlogs/ld1

On panorama this command shows all as N/A

show logging-status device Serial

Type Last Log Rcvd Last Seq Num Rcvd Last Log Generated

Source IP : Default
Destination IP : cms0
Source Daemon : logrcvr
Connection Id : 0123456789-log-collection-lr-cms0-def
Log rate: 0
config N/A N/A N/A
system N/A N/A N/A
threat N/A N/A N/A
traffic N/A N/A N/A
hipmatch N/A N/A N/A
gtp-tunnel N/A N/A N/A
userid N/A N/A N/A
iptag N/A N/A N/A
auth N/A N/A N/A
sctp N/A N/A N/A

Source IP : Default
Destination IP : cms0
Source Daemon : mgmtsrvr
Connection Id : 0123456789-log-collection-ms-cms0-def
Log rate: 0
config N/A N/A N/A
system N/A N/A N/A
threat N/A N/A N/A
traffic N/A N/A N/A
hipmatch N/A N/A N/A

gtp-tunnel N/A N/A N/A
userid N/A N/A N/A
iptag N/A N/A N/A
auth N/A N/A N/A
sctp N/A N/A N/A

Error message on firewalls when old panorama was shutdown.

opaque: FW has lost connection to panorama, no log will be forwarded

Also on panorama log storage setting shows only this much space, although 2TB disk is attached(Thin provisioned), sdb1 in output above

Re: Panorama not receiving logs after rebuilding with new OVA

reaper — Wed, 20 May 2020 16:42:43 GMT

@raji_toor you need to add the serial number of the firewall after that command

>show logging-status device Serial 000123456789

Your log partition is fine:

/dev/sdb1 1.7T 77M 1.7T 1%

Re: Panorama not receiving logs after rebuilding with new OVA

raji_toor — Wed, 20 May 2020 18:29:44 GMT

@reaper Yes it is with serail. My mistake i removed serial from last pasted output

r@Panoramanv1> show logging-status device 0123456789

Type Last Log Rcvd Last Seq Num Rcvd Last Log Generated