Devices Stopped Sending Logs to Panorama

[Mohammed_Yasin]

We have five (5) devices managed through Panorama. Two of them are still generating logs, while three of them have stopped sending logs. Please assist.

it the logs Stops to receive from the device and The traffic and threat logs can be viewed when looking directly on the firewalls, but are not visible on Panorama

It has noted that panorama could not able to receive logs from 800 series firewalls But panorama able to receive the logs from the 5k series firewall.

Appliance: M-200
Firmware Version: 8.1.7

[reaper]

is log forwarding enabled on those devices that are unable to send?

Is the panorama accessible from the firewalls?

what is the output for show logging-status?

[Mohammed_Yasin]

Thank you for the update,

• all of sudden the firewall logs are stopped to receive on a panorama device.
• It has noted that panorama could not able to receive logs from 800 series firewall.
• But panorama able to receive the logs from the 5k series firewall.
• Checked logs settings and forward settings, which is ok.
• Panorama and all the firewalls are in the same network.
• Panorama Disk space having enough space.

I have followed this article too.. but the issue remains the same.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFCCA0

[Chacko42]

Hi @Mohammed_Yasin,

what version are you currently running?

I experienced similar problems on Panorama 9.0.5 - after upgrading to 9.0.9h1 it's fine again.

Logs were forwarded to Panorama, but not processed correctly.

In addition: Please check on tcp/3978 if the traffic is correclty send to panorama

Regards

Chacko

[Mohammed_Yasin]

Thank you for the comment.

PAN-OS 8.1.7

[reaper]

any way you could give 8.1.15 a try, as .7 is already quite old and might have a bug?

[Mohammed_Yasin]

I can see them from the device system monitor that,

( description contains 'Disconnected from Log collector Server: XX.XX.XX.X. , source: XX.XX.X.X' )