topic Re: Export traffic log form Panorama via CLI in General Topics

Export traffic log form Panorama via CLI

Koala — Fri, 15 Aug 2014 10:07:31 GMT

Hi,

We're using Panorama 5.0.x for collecting traffic log (which store the log at NFS Server), which I would search (or export) some old logs (around a year before).

I get time out via WebGUI, and tried scp but it only return the log headers

scp export log traffic max-log-count 1048576 end-time equal 2013/10/10@04:45:00 start-time equal 2013/10/10@04:30:00 to XXXX@XXXXX:/home/XXXXX/traffic.csv

How can I export it from CLI?

Thanks.

Re: Export traffic log form Panorama via CLI

gbogojevic — Fri, 08 Jan 2021 19:45:44 GMT

Hi,

You can use following command:

> scp export logdb to <user account>@<IP of SCP server>:<directory path>

More information can be found here:

CLI Commands to Export/Import Configuration and Log Files

Re: Export traffic log form Panorama via CLI

Koala — Fri, 15 Aug 2014 10:44:14 GMT

Hi,

Actually I am not trying to export the logdb, but I want the traffic log for forensic, therefore I would like to get the raw log in csv format.

Re: Export traffic log form Panorama via CLI

gbogojevic — Fri, 15 Aug 2014 11:09:45 GMT

Hi,

You probably used "Generate Time" instead of "Receive Time" OR you did not specify exact time frame (equal has to be exact "Receive Time" on panorama it is not leq or geq). Can you check that?

Re: Export traffic log form Panorama via CLI

Koala — Fri, 15 Aug 2014 17:51:18 GMT

Hi gbogojevic,

Yes, you are right, i used "Generate Time" to filter which really takes a long time and time outed finally.

When I use "Receive Time" in my filter, the result come out right a way.

Thank a lot!!!

Re: Export traffic log form Panorama via CLI

NisterioHD — Fri, 08 Jan 2021 19:37:54 GMT

Hello,

I am having issue accessing this resource. Can someone please send me a refreshed link? Thanks

Re: Export traffic log form Panorama via CLI

jdelio — Fri, 08 Jan 2021 19:46:44 GMT

@NisterioHD and others trying access that link..

The link has been fixed, and here it is:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClfWCAS

Let us know if this link does not work properly.