topic Re: Traffic and Threats not visible in Panorama Monitor despite logs are se in General Topics

Traffic and Threats not visible in Panorama Monitor despite logs are send from FW to Panorama

ArisDizdarevic — Wed, 20 Jun 2018 07:13:16 GMT

It's a while since our system of 3 HA Palo Alto Firewalls stopped showing logs in Panorama.

The logs are generated and forwarded to Panorama as in next two pictures:

Panorama-receiving logsOne of FW sending logsTraffic and Threats not visible

On one of webpages it was suggested we need additional license for wieving logs in Panorama?

licenses

Summary:

Time is synchronized on Panorama and firewalls

Reseting log receiver on Panorama doesn't help (debug software restart process management-server)

We have no clue what to do next so any help would be appreciated.

Re: Traffic and Threats not visible in Panorama Monitor despite logs are send from FW to Panorama

JoeAndreini — Wed, 20 Jun 2018 11:11:42 GMT

What version of Panorama?

How long has panorama been up?

I experienced a similar issue in 7.1.10 and was told that it was probably related to a bug. Restarting panorama fixes it for a few months at a time at my location.

Re: Traffic and Threats not visible in Panorama Monitor despite logs are send from FW to Panorama

ArisDizdarevic — Wed, 20 Jun 2018 18:45:24 GMT

Thanks for the answer,

As for Panorama version we have (also on all FW's we have the same softw. version):

Software Version

7.1.16

Unfortunally reseting the device did not solve the problem... There is still no traffic or threat info for the last 3 months... Firewalls generate logs o.k. and are viewable directly under FW, but Panorama somehow doesn't show them...

Perhaps is there a way to clear past traffic and threat logs on Panorama? Or somehowe restart collecting logs on Panorama and start over? Any idea how to do this?

Anyone else any suggestions?

Re: Traffic and Threats not visible in Panorama Monitor despite logs are send from FW to Panorama

anuj_mor — Wed, 20 Jun 2018 19:12:52 GMT

Have you followed this article?

https://live.paloaltonetworks.com/t5/Configuration-Articles/Palo-Alto-Networks-Firewall-not-Forwarding-Logs-to-Panorama-VM/ta-p/59799

Re: Traffic and Threats not visible in Panorama Monitor despite logs are send from FW to Panorama

OtakarKlier — Wed, 20 Jun 2018 19:25:41 GMT

Hello,

Also make sure the FW's and the Panorama are on the same versions. The Panorama can be a higher version but same base code.

Panorama version 8.0.9 can manage FW version 8.0.1-9 but not 8.1.0.

Hope that makes sense.

Regards,

Re: Traffic and Threats not visible in Panorama Monitor despite logs are send from FW to Panorama

anuj_mor — Wed, 20 Jun 2018 19:30:24 GMT

It can

@OtakarKlier wrote:
Hello,
Also make sure the FW's and the Panorama are on the same versions. The Panorama can be a higher version but same base code.

Panorama version 8.0.9 can manage FW version 8.0.1-9 but not 8.1.0.

Hope that makes sense.

Regards,

Panorama version 8.0.9 can manage 8.0.x or 7.x.x.

"The Panorama can be a higher version but same base code." --> This is not a mandate.

Re: Traffic and Threats not visible in Panorama Monitor despite logs are send from FW to Panorama

ArisDizdarevic — Wed, 20 Jun 2018 19:45:31 GMT

I tried all options and solutions on link you gave me, but still no luck - still there are no new log entries from March this year.

Regarding versions - all versions are the SAME (on Panorama and on all the Firewalls in network).

Any other ideas?...

Re: Traffic and Threats not visible in Panorama Monitor despite logs are send from FW to Panorama

OtakarKlier — Wed, 20 Jun 2018 20:35:53 GMT

Hello,

I would call support and get their involvement.

Good luck.

Re: Traffic and Threats not visible in Panorama Monitor despite logs are se

BigPalo — Tue, 27 Oct 2020 16:42:55 GMT

Did you solve it?

Re: Traffic and Threats not visible in Panorama Monitor despite logs are se

ArisDizdarevic — Wed, 28 Oct 2020 07:30:35 GMT

The matter couldn't be solved by us, neither by level-2 support.

Finally level-3 support stepped in and only when they loged in "core-linux" on firewall they were able to determin the problem - the problem was to many inodes (https://en.wikipedia.org/wiki/Inode)

After level-3 cleanup all the logs and we set log-retention period to 5-months the situation was solved.

Hope this info helps you.

Br, Aris