Expedition ML - not able to find the CSV files from SYSLOG

[Mboghdady]

I'm unable to find the CSV files that were sent from the FW as (expedition is a syslog) 

below are the ML settings:

------------------------------------------------------------

expedition@Expedition:/PAlogs$ ls -l
total 8
drwxrwxrwx 2 expedition www-data 4096 Jul 20 00:00 172.16.16.5
-rwxrwxrwx 1 expedition expedition 17 Jul 17 00:51 ssh-export-test.txt
expedition@Expedition:/PAlogs$

----------------------------------------

[lychiang]

@Mboghdady Have you upgrade your ubuntu by any chance , if you did "sudo apt-get upgrade" , it will break the dependence package that required by Expedition and you will need to re-install a fresh ubuntu server. 

[Mboghdady]

Hi , Thanks for your message,I usually use the below :

sudo apt-get update
sudo apt-get install expedition-beta

[Mboghdady]

I can see and process all the files that exported from the FW (using Scheduled Log Export ) but still the issue on the CSV files that come from Syslog

[Mboghdady]

Any suggestion?

[dgildelaig]

Expedition will check that the serial number in the log file fits with the serial number you have defined for the device in Expedition.

I would suggest two things:

- Verify you have defined the serial correctly, if not, you could enter the correct serial as a HA serial. If this work, you may consider creating the device again with the valid serial.

- If serial is already correct, you can enter the PATH as /PALogs/*.csv

Expedition will check recursively the folders and show all the files that belong to the device. If this works, please let me know and I will check if the issue is about having dots "." in the path you are providing.

[Mboghdady]

Hi, 

- I have verified the serial number by checking the CSV that was received from the FW and it's the same as the configured under the Devices tab on the expedition:

expedition@expedition:~$ tail /PALogs/172.16.16.5/******_traffic_2021_07_23_last_calendar_day.csv

then I tried to remove the device and added it again.

- I tried to enter the CSV path to : /PALogs/172.16.16.5/*.csv and still unable to see the files.

[azuniga]

Hello @Mboghdady 

Go ahead and shoot an email over to fwmigrate@paloaltonetworks.com and maybe we can set up a session to take a look at your issue.

[Mboghdady · Accepted solution]

Solved after upgrade the Expedition version to 1.1.105