- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
02-11-2021 08:03 PM
Before the upgrade everything was working just fine, now after upgrade still I can see the GP-logs sent from the Firewalls to Panorama, but Panorama still unable to sent those logs to Qradar syslog server. Connectivity between the 2 devices is good.
I found the below document to review the configuration to see if anything is missing but the document is for PAN-OS 6.0, 6.1, 7.0 and that is too old. After a lot of research I have been not able to find a document just like this one but for version 8-9 or 10 but without any luck.
HOW TO FORWARD FIREWALL LOGS FROM PANORAMA THROUGH SYSLOG2
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEVCA0
If any one can shed some light regarding this matter will be highly appreciated!!.
02-17-2021 04:51 AM - edited 02-17-2021 04:58 AM
The document you referenced may be old, yet the configuration is the same.
Now, my question for you is more about the upgrade from 8 to 9.
In 8.0, it is a possibility that your Panorama was in Legacy Mode (mgmt and logging combined)
In your upgrade to 9.0, perhaps, not sure, that your Panorama is now only in mgmt mode, and that is why it is not forwarding your logs.
Look at your dashboard and confirm what the system-mode is.
for mine.. I needed to upgrade CPU and memory for my 9.x upgrade to create a panorama mode vs (mgmt-only, log-collector modes)
Now you may still have legacy mode, but it is the first place you should look.
UPDATE: If it is ONLY the GP logs, then my mistake.
It could be in the log collector group area where you see all of the types of logs
but you need to confirm you have scrolled all the way to the left to choose GP logs (if I am understanding your issue)
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!