Problems with importing logs

Reply
L2 Linker

Problems with importing logs

I've added a panorama device into Expedition and i'm trying to import logs that I've exported from panorama and am running into an issue.  I put the csv file in /home/expedition/logs.  The csv is called panorama.csv.  /home/expedition/logs/* (logs path in expedition).  I've changed changing permissions on the file/folder and ownership and no matter what, the csv doesn't show up in expedition for importing.  Any ideas?

L3 Networker

Re: Problems with importing logs

Try exporting the logs from the firewall(s) instead. Worked for me, and we have Panorama as well.
L7 Applicator

Re: Problems with importing logs

Expedition does filter by serial number. So when you dfined your Panorama you assigned a Serial there but inside the logs exported from panorama it will show the Serials from the Firewalls who were generating the logs so there is no coincidence and for instance you wont be able to see the CSV files under your Panorama....  

 

The right approach will be adding Panorama, retrieve the connected devices and then from the devices imported into the one you want to focus then add the CSV files under it.  From the project perpective you have to add panorama, import the panorama config and from the log connector select the devicegroup where your firewall is part and Expedition will take care of everything else.

L2 Linker

Re: Problems with importing logs

Ok, I've added my Panorama Device, retrieve connected devices and they show up.  Now, I've scheduled a Log Export on my M-100 (Setup in Log Collector Mode Only), however I'm not getting the log into my /home/expedition/logs/ directory.  I'm using SCP to send directly to my Expedition VM.  Doing a LS on that directory, i see the ssh-export-test.txt file that's created when the export was setup.  Any suggestions?

L1 Bithead

Re: Problems with importing logs

I'm still having this issue with a vm firewall that is not in panorama. I can see the log in the /home/expedition/logs folder but when using /home/expedition/logs/* and clicking on the search button it still is not finding any logs. I've tried this on other phsyical firewalls as well and expedition can't see any of them. Any thoughts?

L7 Applicator

Re: Problems with importing logs

When you define Panorama you have to assign the panorama serial, If you are adding the logs under your panorama but the logs were genrated by a firewall with a diffrent serial they will not be shown under panorama, you should has to retrieve cojnnected devices and then under the device configure the PATH....

L3 Networker

Re: Problems with importing logs

Have you thought about having the devices that are learned as part of Panorama "inherit" an M.Learning log path from the setting for Panorama?

L7 Applicator

Re: Problems with importing logs

So that its already implemented, if oyu configure a PATH for Panorama all the devices managed by it will inherit the same PATH unless you override it...

Highlighted
L3 Networker

Re: Problems with importing logs

Ah, yes. I went into the Panorama device profile and updated/saved the log path, and the firewalls below it all updated. Nice. I must have just biffed it somehow originally on the 3 firewall devices I was concentrating on.

 

Thanks!

L2 Linker

Re: Problems with importing logs

Anyone getting this to work?  I've attached some screenshots,thoughts?Screenshot - 07_05_2018 , 6_44_04 PM.pngNo Logs Available to importScreenshot - 07_05_2018 , 6_43_03 PM.pngDevices in Expedition. Physical Firewalls were added by PanoramaScreenshot - 07_05_2018 , 6_42_51 PM.pngCSV File in /home/expedition/logs directoryScreenshot - 07_05_2018 , 6_41_50 PM.pngScheduled Export from the Physical Firewall

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!