I have one instance of Expedition where I am apparently unable to manually trigger log processing for enabled files (Devices/M.learning). Initially, Expedition was set to autoprocess CSV files, and it did it successfully. After a reboot, three logfiles piled up due to scheduled log export via scp from firewall and I didn't notice that the task manager for expedition wasn't started until after the three piled up.
Since this box got stood up, the "Process Enabled Files" button is greyed out. Any ideas?
1 CSV pending...
I also noticed that automatic processing isn't finishing either. I administratively disabled a file for processing and when doing that, Expedition changes the device from "PA-52xxx" to "PA-50xxx" (I have both types in this panorama, fwiw). Changing back to enabled changes the FW type back to 5250. Not sure what that's about or if it matters. The button for processing enabled files never changes than what is shown here. In my lab, I can process manually, but not on this particular instance of Expedition. All log files present are named consistently with PA52xxx, and I've verified that SN in logs matches the 5250 I'm targeting for ML.
Noticing that automatic processing isn't succeeding either, I've found my sparkRAM was only defined as 1100mb. I've updated that to 7000mb, will try again via daily automatic processing by adjusting time.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!