topic Re: Devices Stopped Sending Logs to Panorama in General Topics

Devices Stopped Sending Logs to Panorama

Mohammed_Yasin — Thu, 23 Jul 2020 10:11:35 GMT

We have five (5) devices managed through Panorama. Two of them are still generating logs, while three of them have stopped sending logs. Please assist.

it the logs Stops to receive from the device and The traffic and threat logs can be viewed when looking directly on the firewalls, but are not visible on Panorama

It has noted that panorama could not able to receive logs from 800 series firewalls But panorama able to receive the logs from the 5k series firewall.

Appliance: M-200
Firmware Version: 8.1.7

Re: Devices Stopped Sending Logs to Panorama

reaper — Thu, 23 Jul 2020 10:24:24 GMT

is log forwarding enabled on those devices that are unable to send?

Is the panorama accessible from the firewalls?

what is the output for show logging-status?

Re: Devices Stopped Sending Logs to Panorama

Mohammed_Yasin — Thu, 23 Jul 2020 10:46:05 GMT

Thank you for the update,

all of sudden the firewall logs are stopped to receive on a panorama device.
It has noted that panorama could not able to receive logs from 800 series firewall.
But panorama able to receive the logs from the 5k series firewall.
Checked logs settings and forward settings, which is ok.
Panorama and all the firewalls are in the same network.
Panorama Disk space having enough space.

I have followed this article too.. but the issue remains the same.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFCCA0

Re: Devices Stopped Sending Logs to Panorama

Chacko42 — Thu, 23 Jul 2020 11:33:48 GMT

Hi @Mohammed_Yasin,

what version are you currently running?

I experienced similar problems on Panorama 9.0.5 - after upgrading to 9.0.9h1 it's fine again.

Logs were forwarded to Panorama, but not processed correctly.

In addition: Please check on tcp/3978 if the traffic is correclty send to panorama

Regards

Chacko

Re: Devices Stopped Sending Logs to Panorama

Mohammed_Yasin — Thu, 23 Jul 2020 11:35:54 GMT

Thank you for the comment.

PAN-OS 8.1.7

Re: Devices Stopped Sending Logs to Panorama

reaper — Thu, 23 Jul 2020 11:49:20 GMT

any way you could give 8.1.15 a try, as .7 is already quite old and might have a bug?

Re: Devices Stopped Sending Logs to Panorama

Mohammed_Yasin — Thu, 23 Jul 2020 11:58:58 GMT

I can see them from the device system monitor that,

( description contains 'Disconnected from Log collector Server: XX.XX.XX.X. , source: XX.XX.X.X' )