How to Collect Logs from GlobalProtect 5.0 Clients

• There are 2 different ways that you can get log files from GlobalProtect, inside the "Troubleshoot" tab. 
• The first way to see the logs, will be from starting and stopping the logs. This can be helpful to start and stop the logs to capture a certain Connection issue or another event.

1. Start by right-clicking the GlobalProtect icon on the taskbar

2. Then hit Settings

 

3.  Click the sprocket icon in the upper right.

 

4. On the GlobalProtect Agent window, go to the Troubleshooting tab, select Logs.

• Note: sIn the newer GP Agents click on "Advanced" to see the "Start" button

1. Set Log type to PanGP Service. The PanGP Service (Windows Service) logs every connection attempt and all errors encountered during that time.
2. Set Debug Level to Debug
3. Before a certain event happens, click Start to start the logs. After the event, click Stop to stop the logs.

4. After you have logs on the screen, you can take a screenshot, or just scroll through the event as it is happening. This can help show exactly what is going on when the issue occurs. 

5. The second way to collect logs would be from the same Troubleshooting window, click the Collect Logs button.

1. This will bring up the Save Logs window. Click the Open Folder button

2. This brings up a Windows Explorer window. Look for the GlobalProtectlogs.zip file.  This is what you can unzip yourself or send off to Support so they can help troubleshoot what is going on.

 

 

Syntax:
sh /Applications/GlobalProtect.app/Contents/Resources/gp_support.sh <save location>

user1@Labhost% sh /Applications/GlobalProtect.app/Contents/Resources/gp_support.sh /Users/user1

Executing: /usr/bin/kmutil showloaded
No variant specified, falling back to release
/Applications/GlobalProtect.app/Contents/Resources /Applications/GlobalProtect.app/Contents/Resources
a DNS.txt
a DemPathTestService-2023-06-16-111008.ips
a IfConfig.txt
a MachineState.txt
a NetStat.txt
a PanGPA.log
a PanGPA.log.old
a PanGPS.log
a PanGPS.log.old
a PanGpHip.log
a PanGpHipMp.log
a PanNExt.log
a PanNExt.log.old
a Proxy.txt
a RoutePrint.txt
a SystemInfo.txt
a Top.txt
a com.paloaltonetworks.DemUpdateService 2023-06-05--02-08-33-832.log
a com.paloaltonetworks.GlobalProtect.settings.plist
a debug_drv.log
a debug_drv_old.log
a pan_gp_event.log
a pan_gp_hrpt.xml
a pan_gp_trb.log
a sysext.service.log
a system.log
a system.log.0.gz
a system.log.1.gz
a system.log.2.gz
a system.log.3.gz
a system.log.4.gz
a system.log.5.gz
a system.log.6.gz
a systemextensionsctl.txt
/Applications/GlobalProtect.app/Contents/Resources
The support file is saved to /Users/user1/GlobalProtectLogs.tgz

1. The PANGPI and PANGPA logs are stored in the below location on the Linux Machine. 

/home/<user>/.Globalprotect

2. To collect the Client logs use the below commands on the terminal. 

user1@Labhost:~$ globalprotect
collect-log

Start collecting...
collecting network info...
collecting machine info...
copying files... 
generating final result file...
The support file is saved to /home/user/.GlobalProtect/Collect.tgz

3. Export the Collect.tgz file from the above given location.

• For mobile devices (Android and iOS)

1.  In GlobalProtect agents for mobile devices, you can select Help > Troubleshoot and then choose to email the logs to a recipient. This operation requires an Email Account.