topic Log Collector not receiving logs. in General Topics

Log Collector not receiving logs.

VarunRao — Mon, 27 Jul 2020 02:02:04 GMT

Hi All,

We have deployed 2xM200 Log collectors for log collection. They are registered on the panorama and show in-sync. I have done the collector-group settings. Now when I go to Panorama > Managed collector > the log collectors show disconnected status (screenshot attached). With the message "Log collector <serial number> failed to connect to <serial number> Inter-LC"

The 2 log collectors are to be deployed in redundancy.

Below is the output of "show logging-status" on the firewalls.

-----------------------------------------------------------------------------------------------------------------------------
Type Last Log Created Last Log Fwded Last Seq Num Fwded Last Seq Num Acked Total Logs Fwded
-----------------------------------------------------------------------------------------------------------------------------

Log Collector : xxxxxxxxxxxxxxx
Conn ID : lr-172.16.100.100
Connection IP : lr-172.16.100.100
Conn Source IP : lr-172.16.100.100- - def
High speed mode : Disabled
Connection Status : lr-172.16.100.100- - Inactive
DNS :
msg : Successfully resolved FQDN for connid (lr-172.16.100.100-def), IP (172.16.100.100)
status : success
timestamp : 2020/07/24 10:49:30

Registration :
msg : Timeout:4310 triggered for lc_conn_id:lr-172.16.100.100-def
status : failure
timestamp : 2020/07/27 10:42:35

SSL :
msg : ssl channel established
status : success
timestamp : 2020/07/24 10:49:32

TCP :
msg : tcp connection established
status : success
timestamp : 2020/07/24 10:49:30

Conn Uptime : 0
Re-conn Count : 0

Rate : 0 logs/sec

traffic Not Available Not Available 0 0 0
threat Not Available Not Available 0 0 0
hipmatch Not Available Not Available 0 0 0
gtp-tunnel Not Available Not Available 0 0 0
auth Not Available Not Available 0 0 0
userid Not Available Not Available 0 0 0
sctp Not Available Not Available 0 0 0
config Not Available Not Available 0 0 0
system Not Available Not Available 0 0 0

Connection status shows "inactive"

How can I make the firewalls send logs to log collectors and the status to be active.

Re: Log Collector not receiving logs.

Thyrion — Tue, 28 Jul 2020 12:41:38 GMT

you'll first need to get the log collectors to sync up and connected to your panorama before you start looking at your firewall

connect to the individual log collectors and look for error messages there. once they connect to panorama and each other successfully, the firewall will start sending logs

Re: Log Collector not receiving logs.

MP18 — Tue, 28 Jul 2020 17:33:15 GMT

@VarunRao

Are you using same Log collector IP for Management and receiving logs from PA?

Make sure in Panorama , Collector Groups then click on device log forwarding.

Make sure your firewall is added there.

Then in Log collector CLI Run this command

show logging-status device serial number of FW

Also make sure From FW management Interface you can ping the log collector ip

Regards

Re: Log Collector not receiving logs.

VarunRao — Wed, 05 Aug 2020 02:11:46 GMT

Hi,

the log collectors show in-sync on the panorama.

How do I ensure they are connected to each other? Is there a config to ensure the 2 are talking to each other?

Re: Log Collector not receiving logs.

VarunRao — Wed, 05 Aug 2020 02:17:58 GMT

Are you using same Log collector IP for Management and receiving logs from PA? Yes using same interface for management and receiving logs.

Make sure in Panorama , Collector Groups then click on device log forwarding. Yes it is configured.

Make sure your firewall is added there. Yes

Then in Log collector CLI Run this command

show logging-status device serial number of FW

admin@logcollector01> show logging-status device 0xxx11584xx

Type Last Log Rcvd Last Seq Num Rcvd Last Log Generated

Also make sure From FW management Interface you can ping the log collector ip

able to ping

Re: Log Collector not receiving logs.

MP18 — Thu, 06 Aug 2020 16:57:28 GMT

Use below command to check if logrcvr is running or not?

show system software status | match logrcvr

if not running it will need restart

 > debug software restart process log-receiver

show netstat

and look for IP of Log collector.

Also when you run command

show logging-status

make sure hostname of log collector gets resolved.

My setup which is working

Connection Status : ms-10.7.12.104- - Active
DNS :
msg : Successfully resolved FQDN for connid (ms-10.7.12.104-def), IP (10.7.12.104)
status : success
timestamp : 2020/01/09 13:42:57

IS there any firewall between PA and log collector?

Re: Log Collector not receiving logs.

VarunRao — Thu, 06 Aug 2020 23:19:40 GMT

The logrcvr process seems to be running fine, although for show logging-status, DNS resolution is fine but for Registration I am seeing a failure:

Registration :
msg : Timeout:4310 triggered for lc_conn_id:lr-172.16.100.100-def
status : failure
timestamp : 2020/08/06 10:42:35

What is this registration for ?

Re: Log Collector not receiving logs.

MP18 — Fri, 07 Aug 2020 16:11:33 GMT

@VarunRao

Make sure your log collectors are registered and they have valid licenses.

You need to add the Firewall in Panorama under Collector Groups and device Log Forwarding

Also make sure Your Log collector is in right mode for logging only no gui access then they need to be in logging mode.

Make sure you have done this as explained in below url

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmVlCAK

Regards

Re: Log Collector not receiving logs.

VarunRao — Tue, 18 Aug 2020 01:45:07 GMT

The issue was resolved by opening a case with TAC.

I was missing the check box for sending logs to Panoram/logcollector on the log forwarding profile:

Object > Log forwarding profile > select your profile > check the box option for Panorama/log collector

This would send the traffic from the firewall to the dedicated log collector.

Re: Log Collector not receiving logs.

MP18 — Tue, 18 Aug 2020 05:17:35 GMT

@VarunRao

Thanks for updating us regarding the solution.

It will help someone in community in near future.

Regards