topic Re: No logs in the monitor > traffic tab? in General Topics

No logs in the monitor > traffic tab?

Ayush_paloalto — Tue, 11 Jun 2019 06:18:54 GMT

Hello All,

1.) I have just installed Palo Alto 7.1 in Eve-NG, and made two interfaces as Vwire with zone Trust and Untrust.

2.) I am able to access access everthing (e.g. internet, ping, etc.) hence policies are working fine as I have created a policy to allow everything from Trust to Untrust.

However I am not able to see any Traffic logs in the GUI it is blank.

Kindly see the below screenshot for your reference and let me know what's the reason please.

Thanks in advance.

Re: No logs in the monitor > traffic tab?

hshawn — Tue, 11 Jun 2019 16:00:16 GMT

This may sound obvious but make sure you are enabling the logging on the security policies your traffic is hitting. you can log at session start and or sesssion end.

Re: No logs in the monitor > traffic tab?

OtakarKlier — Tue, 11 Jun 2019 16:24:02 GMT

Hello,

Also the default intra and inter zone policies do not log so you have to set them to log as well.

Regards,

Re: No logs in the monitor > traffic tab?

MP18 — Thu, 13 Jun 2019 04:26:10 GMT

Yes i agree with Okta.

Re: No logs in the monitor > traffic tab?

htawedrous — Thu, 23 Apr 2020 18:52:08 GMT

Hello,

Does anybody got a resolution? I have the same problem with a PA in EVE-NG. Tried 2 different images. thank you

Re: No logs in the monitor > traffic tab?

ravisingh.z — Fri, 24 Apr 2020 21:06:15 GMT

Same issue, logs are not showing in GUI and as well as CLI but logs are being written.

admin@PA-VM> show log traffic
Time App From Src Port Source
Rule Action To Dst Port Destination
Src User Dst User End Reason
Rule_UUid
====================================================================================================
admin@PA-VM> debug log-receiver statistics

Logging statistics
------------------------------ -----------
Log incoming rate: 1/sec
Log written rate: 1/sec
Corrupted packets: 0
Corrupted URL packets: 0
Corrupted HTTP HDR packets: 0
Corrupted HTTP HDR Insert packets: 0
Corrupted EMAIL HDR packets: 0
Logs discarded (queue full): 0
Traffic logs written: 120

Re: No logs in the monitor > traffic tab?

htawedrous — Sat, 25 Apr 2020 02:18:02 GMT

I read that the VM needs to be licensed for monitoring, clustering and some other features to work. Not sure if it’s true

Re: No logs in the monitor > traffic tab?

ACHABROUK — Sat, 09 May 2020 16:29:32 GMT

Yes the VM needs to be licensed,

but you can still see some logs over

Policies>security> "click on your rule" > usage

Or- from CLI

> show session all

thanks!

Re: No logs in the monitor > traffic tab?

SyedHyder — Thu, 18 Jun 2020 16:56:28 GMT

did you find a solution, I have the same problem...

Re: No logs in the monitor > traffic tab?

SyedHyder — Fri, 19 Jun 2020 00:28:46 GMT

Palo doesn't log on VM PAN OS without license...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm2mCAC

Re: No logs in the monitor > traffic tab?

ACHABROUK — Fri, 19 Jun 2020 00:52:59 GMT

you PAN needs to be licensed to see logs 😃

Re: No logs in the monitor > traffic tab?

MP18 — Fri, 19 Jun 2020 02:56:38 GMT

Agree if it is VM its need license.

Learn something new today

Re: No logs in the monitor > traffic tab?

JamesChim — Thu, 10 Sep 2020 07:17:21 GMT

I have the PA-220 happen the same issue

The Traffic, Threat, URL Filtering and etc no log after the Aug-2020

Anyone know how to solve the problems?

Re: No logs in the monitor > traffic tab?

MP18 — Tue, 15 Sep 2020 14:29:37 GMT

@JamesChim

If you do not see any logs in GUI and it used to work before please go through these links

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClozCAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmA4CAK

Also as log rece listen on udp port 3012 so run below command

PA)> show netstat listening yes numeric-ports yes all yes | match 3012
udp 0 0 mgmt:47390 mgmt:3012 ESTABLISHED
udp 0 0 *:3012 *:*

Regards

Re: No logs in the monitor > traffic tab?

ArendvanderKolk — Mon, 18 Oct 2021 06:50:48 GMT

My PAN-OS is licensed and also have no logs in the monitor. Logs at session end is on in the policy rules.

Re: No logs in the monitor > traffic tab?

ArendvanderKolk — Mon, 18 Oct 2021 11:00:06 GMT

"When the time is manually changed back, it creates the mismatch between the GUI time stamp and the logs"

This indeed was the problem. Timing issue. Solved now. Thank you very much

Re: No logs in the monitor > traffic tab?

JesusGarza — Fri, 07 Oct 2022 22:48:58 GMT

how did you solve it ? i have the same issue

Re: No logs in the monitor > traffic tab?

oreegamii — Tue, 11 Oct 2022 16:15:48 GMT

How could you not share the fix when you see multiple people have this issue. common man

Re: No logs in the monitor > traffic tab?

JamesChim — Tue, 11 Oct 2022 18:34:11 GMT

In my memory, the traffic have not update, you need to erase all traffic log to solve the problem.

Re: No logs in the monitor > traffic tab?

JamesChim — Tue, 11 Oct 2022 18:59:08 GMT

I need to Clear All Log from PA-220 to solve the problem in my case.