No logs in wildfire log section on device- PAN OS 5.0.3

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

No logs in wildfire log section on device- PAN OS 5.0.3

L4 Transporter

Hi ,

Even we have the valid wildfire subscription, not able to see any logs in wildfire logs in device but in the data-filtering logs for some exe files it is showing wildfire-upload-success         ( means file has uploaded to wildfire cloud for analysis).

I executed the commands  >test wildfire registration         -  showing registered

                                      >show wildfire status               - showing 4 files forwarded

Dynamic updates for wildfire has scheduled for 15 minute.

But still after 3 hours also i am not able to see any (verdict) logs in wildfire logs section on device.

"Is only for verdict"malicius" will be sent to device? 

Regards,

Gururaj

1 accepted solution

Accepted Solutions

L5 Sessionator

By default, only malware logs are delivered to the device.

To turn on receiving reports for benign files:

CLI

#set  deviceconfig setting wildfire report-benign-file yes

#commit

View solution in original post

3 REPLIES 3

L5 Sessionator

By default, only malware logs are delivered to the device.

To turn on receiving reports for benign files:

CLI

#set  deviceconfig setting wildfire report-benign-file yes

#commit

L5 Sessionator

Here is some more relevant information regarding Wild fire

https://live.paloaltonetworks.com/docs/DOC-5266

Symptom

When a wildfire-upload-skip message is seen in the data filtering logs, all the files do not appear on the WildFire portal.

Cause

In PAN-OS 5.0, when a file is received by the firewall, a hash is created and checked with the WildFire server. If the hash matches on the WildFire server, the action wildfire-upload-skip is taken. At this point, one of the following occurs based on the categorization of the file:

  • If the file had been previously determined to be malicious, then the report, previously generated when the verdict was made, appears on the WildFire server.
  • If the file was not malicious and was determined to be benign, then the report is not shown on the WildFire server.

Thanks

Thank you Nadir  🙂

  • 1 accepted solution
  • 3053 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!