Panorama Query Log Fails

[r_buchwalder]

Hello all

I run into a failure on Playbook Panorama Query Logs.

The failure is:

"Set vsys for firewall or Device group for Panorama"

This happen on the GeneralPolling Playbook and there at the task RunPollingCommand.

I've defined Device Group and asking Panorama - but the failure still occours.

Does anyone have any Idea, what this could be?

thanks

roger

[bkatzir]

Hey Roger.

I was able to query panorama logs successfully.
Where did you define the `Device Group`?
It should be defined in the instance configuration.

Bar.

[r_buchwalder]

Hello Bkatzir

I've defined the Device Group in the Integrations (where all the settings are defined for Panorama)

It's name is:

Device group - Panorama instances only (write shared for Shared location)

and there is "shared" in it...

Thank you

roger

[bkatzir]

Can you upload some screenshots or send them to me?
I'm interested in knowing that you are indeed running the commands/Playbooks from the correctly configured instance.
bkatzir@paloaltonetworks.com

[r_buchwalder]

Hello bkatzir

I've send you just now an E-Mail

Thank you

roger

[bkatzir]

For future reference:
After a correct configuration of the integration instance we have been encountering

```
calling panorama_get_traffic_logs(‘32936’,)
Query logs failed. Reason is: Query timed out
```

This error comes from the pan-os. the search query job which we are creating is timing out.
I talked with the pan-os team - there is no way to lengthen the TTL of the job via the API.

A case was created to the pan-os team: 01731887