Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Log import of Pano managed firewall no longer works after upgrade to 1.0.99.1

L2 Linker

I was able to parquet logs every day for 10 days.  After the upgrade, Expedition no longer sees new files.  Path and permissions have not changed.

 

A stand-alone firewall has no issue.

 

Should I delete the Pano and managed devices and recreate?

1 ACCEPTED SOLUTION

Accepted Solutions

Many thanks to dgildelaig for helping me understand the solution.  I had logs, but they were empty because the firewall had failed over.  Here is what I believe to be the best practice.  He will correct me if I am wrong.

 

Configure both firewalls in an HA pair to do log export.

On both firewalls, test the SCP twice.  The first time so that they have the key stored, the 2nd for it to create the test file and you know it worked.

Under the device configuration of both devices in Expedition, specify the HA device serial number so that it will look for logs from either of them.  Expedition checks to make sure the file has more than just headers.  If it doesn't, it won't even show up in the file list for Processing.

View solution in original post

10 REPLIES 10

L2 Linker

I deleted the Panorama device which removed all child devices.  Rebooted Expedition.  Re-added Panorama, generated API key, downloaded Panorama devices, downloaded running config, look for logs under machine learning, still no results.  All files in the Expedition screen cap were already converted to parquet format.

 

expd2.PNGexped1.PNG

Should we do a Zoom session to check it further?

Please, contact us at fwmigrate at paloaltonetworks dot com.

Many thanks to dgildelaig for helping me understand the solution.  I had logs, but they were empty because the firewall had failed over.  Here is what I believe to be the best practice.  He will correct me if I am wrong.

 

Configure both firewalls in an HA pair to do log export.

On both firewalls, test the SCP twice.  The first time so that they have the key stored, the 2nd for it to create the test file and you know it worked.

Under the device configuration of both devices in Expedition, specify the HA device serial number so that it will look for logs from either of them.  Expedition checks to make sure the file has more than just headers.  If it doesn't, it won't even show up in the file list for Processing.

Hi, did the tool showed an "No supported files to process" Error in the M.Learning tab?

 

Thanks in advance,

Andre

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!