WildFire Submissions no logs

[TranceforLife]

Hi All,

PA-3050 PAN-OS 7.1.6

While checking WildFire configuration l have noticed strange thing where no logs display on the WildFire Submission or Data Filtering tab:

When l test with the KB article below can observe that the test file is sent to the portal and verdict is assigned:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Test-WildFire-with-a-Fake-Malicious-...

Had exactly the same on our lab firewall where no logs were seen and files are sent to the portal same as file blocking profiles didn't work. I did reboot the box and the issue is gone but l cannot do the same  with this one. Any ideas on how  to fix this?

CLI for WildFire status and statistics looks good to me:

Thx,

Myky

[bmorris1]

Hi Myky,

Hmm seems a bit odd, have a check on the following things:

- Logging enabled on the security policy

- Quota for wildfire logs has space (Device > Setup > Logging and Reporting Settings)

- Check the status of the processes on the management plane - show system resources (logrcvr/varrcvr) 

hope this helps,

Ben

[TranceforLife]

@bmorris1 good points. Will do. For the log space should be fine as it is a new install. 

Thx,

Myky

[TranceforLife · Accepted solution]

Hi,

The below command did a trick:

> debug software restart process vardata-receiver

Logs are seen now.

Thx,

Myky

[BPry]

@TranceforLife For some reason I didn't see this one when looking through this morning. I'm not sure what you are running this on but this appears to be a pretty common error that I've seen on 3020s where I probably have to restart vardata-receiver at least once a month to get the logs to start showing again. 

I've slowly started to work in a restart of the boxes once a month and just switching between the HA pairs for all clients running the 3000 series to get away from this issue. I'm not exactly sure why it ever stops in the first place but since it's easy enough to clear up I never really worry about it. 

[TranceforLife]

Hello,

Thanks. This is a fist time l run into this issue. Yes it is 3050 device so looks like l need to remember that command :0 Same not sure why this is happening but happy it is fixed.

Thx,

Myky

[Pattarachai]

@TranceforLife   I would like to know because I found this same issue but It is only some file not to show log if use "debug software restart process vardata-receiver" it work? please suggest me.