topic Re: delete ikemgr.log without impacting existing VPN tunnels in General Topics

delete ikemgr.log without impacting existing VPN tunnels

dtran — Thu, 07 Jan 2021 13:40:27 GMT

This file is getting too big for me and it takes forever to search for things in that file. I would like to purge/delete this file WITHOUT impacting existing VPN tunnels. I want to be able to debug VPN tunnels later on as well.

1- delete debug-log mp-log file ikemgr.log

2- debug software restart process ikemgr

Is this going to impact EXISTING VPN tunnels?

TIA

Re: delete ikemgr.log without impacting existing VPN tunnels

reaper — Thu, 07 Jan 2021 13:48:05 GMT

why do you want to restart the ikemg process?

restarting that process will impact all vpn tunnels

you can simply delete the ikemgr.log without needing to restart the process and if the file is growing too large too quickly you may want to look into setting the log level lower:

debug ike global show
debug ike global on normal

Re: delete ikemgr.log without impacting existing VPN tunnels

dtran — Thu, 07 Jan 2021 15:04:51 GMT

why do you want to restart the ikemg process?

restarting that process will impact all vpn tunnels

you can simply delete the ikemgr.log without needing to restart the process and if the file is growing too large too quickly you may want to look into setting the log level lower:

debug ike global show
debug ike global on normal

@Tom Piens:

If I delete the ikemgr.log file without restarting the process, I will not be able to see any new IPSec debug. That's my issue.

Is there anything in PAN like vi that I can get into the file and remove everything without deleting the file?

Re: delete ikemgr.log without impacting existing VPN tunnels

reaper — Thu, 07 Jan 2021 15:17:21 GMT

Which PAN-OS are you on? I'd expect this file to get pruned automatically

you may want to reach out to TAC to have this investigated

Re: delete ikemgr.log without impacting existing VPN tunnels

dtran — Thu, 07 Jan 2021 15:21:08 GMT

@reaper:

I also notice that "debug software restart process ikemgr" does NOT impact ALL VPN tunnels. For example, I have two IPSec VPN tunnels from this PaloAlto, running version 8.1.17, an IKEv2 with a Cisco ASA firewall and an IKEv1 with a Cisco IOS router.

When I perform "debug software restart process ikemgr", it took down the IPSec tunnel with the Cisco ASA but not the IPSec tunnel with the Cisco IOS router.

Still waiting to hear back from TAC. Not very good support.