Do not display Threat log with descent sort on palo alto device 3020

[Register_Security]

Hi All,

I have a problem to view threat log on device.

My device is 3020 model, with 5.0.9 version, threat verion: 445-2292.

I do not see any threat log record when I select DESC sort, but I can see threat log with ASC sort.

Please help me why ?

thanks

[HULK]

Hello,

DESC or ASC are just the order ( Ascending and Descending). Hence, it should not matter what sort you will select.:smileyshocked:  Have you tried increasing the "Displaying Logs" size..?

Thanks

[hshah]

Hi Register,

When you change order, you are supposed to hit Enter. Make sure you have done it.

Make sure filter criterias are same for both asc and dsc.

Let us know your findings.

Regards,

Hardik Shah

[HULK]

Please verify the same from CLI also:

> show log threat direction equal forward

Example:

------------------

admin@-3020> show log threat direction equal

  backward   backward    >>>>>> DESC

  forward       forward       >>>>>>  ASC

NOTE: You need not to hit "enter", it will take automatically( from GUI ).

Hope this helps.

Thanks

[Register_Security]

Hi Hulk,

I can see all of threat log on console, the problem can not see threat log on GUI (Monitor --> Logs --> Threar)

Please help.

[HULK]

Could you please share below mentioned CLI command output:

> show system resources follow   >>>>> then press Shift + M

Thanks

[Register_Security]

Hi Hulk,

Result of show system resources follow

top - 13:49:05 up 37 days, 11:29,  1 user,  load average: 0.00, 0.00, 0.00

Mem:   3852228k total,  3719088k used,   133140k free,   129616k buffers

Swap:  2008084k total,     1576k used,  2006508k free,  2391864k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                   

1975 root      20   0  501m 350m 6960 S    2  9.3 932:08.74 mgmtsrvr                                                                                                  

2000 root      20   0  273m 147m  10m S    1  3.9 175:40.64 devsrvr                                                                                                   

2011 root      20   0  325m 129m 7312 S    3  3.4 327:53.55 logrcvr                                                                                                   

1978 root      20   0  156m  73m  64m S    0  2.0   3:03.56 useridd                                                                                                   

26616 nobody    20   0  119m  56m 4272 S    0  1.5   1046:00 appweb3                                                                                                   

2034 root      20   0 47864  37m 1868 S    1  1.0 226:18.66 snmpd                                                                                                     

16063 quoclc    20   0 43412  17m 9196 S    0  0.5   0:00.38 cli                                                                                                       

1824 root      20   0 53064  12m 2680 S    0  0.3   7:38.81 dagger                                                                                                    

26614 nobody    20   0 76120  12m 3040 S    0  0.3   0:14.39 appweb3                                                                                                   

2019 root      20   0 93448  11m 2636 S    0  0.3   2:51.68 satd                                                                                                      

2025 root      20   0  135m  11m 2488 S    0  0.3   9:16.03 routed                                                                                                    

26625 nobody    20   0 81624  10m 3284 S    0  0.3   0:11.02 appweb3                                                                                                   

2016 root      20   0  250m 7628 2324 S    0  0.2  13:04.66 varrcvr                                                                                                   

1799 root       0 -20 31736 6852 2392 S    0  0.2  18:36.90 masterd_core                                                                                              

1818 root       0 -20 14032 6696 1332 S    0  0.2  32:32.04 masterd_manager                                                                                           

1826 root      20   0 56020 6384 2396 S    0  0.2   4:19.47 cryptod                                                                                                   

1825 root      30  10 13656 6376 2224 S    0  0.2  15:31.45 python                                                                                                    

2026 root      20   0  108m 5608 3220 S    0  0.1   0:24.85 authd                                                                                                     

1816 root      15  -5 20724 4912 1536 S    1  0.1 231:50.67 sysd                                                                                                      

2024 root      20   0 53688 4424 2052 S    0  0.1   0:01.58 pppoed                                                                                                    

2023 root      20   0 52664 4408 2068 S    0  0.1   0:01.32 dnsproxyd                                                                                                 

2021 root      20   0 82560 4296 2308 S    0  0.1   0:37.78 sslmgr                                                                                                    

32688 root      20   0  4268 4264 3280 S    0  0.1   0:00.02 ntpd                                                                                                      

2010 root      20   0 69616 4200 2640 S    0  0.1   0:56.94 ikemgr                                                                                                    

2014 root      20   0 78600 3716 2336 S    0  0.1   2:06.81 rasmgr                                                                                                    

2018 root      17  -3 35920 3648 2236 S    0  0.1   6:13.69 ha_agent                                                                                                  

3884 root      20   0 10648 3636 1944 S    0  0.1  28:05.31 packet_path_pin                                                                                           

1831 root      20   0  133m 3576 1844 S    0  0.1  14:05.07 sysdagent                                                                                                 

2022 root      20   0 35312 3472 2080 S    0  0.1   0:02.05 dhcpd                                                                                                     

2015 root      20   0 76808 2600 1580 S    0  0.1   2:02.81 keymgr                                                                                                    

1843 root      20   0 26492 2256 1444 S    0  0.1   0:34.19 chasd                                                                                                     

16038 root      20   0  6876 2236 1796 S    0  0.1   0:00.06 sshd                                                                                                      

1844 root      20   0  3988 2216 1224 S    0  0.1   0:00.01 tscat            

What is problem on my device ?

[HULK]

The above mentioned output looks good to me. The firewall looks healthy. Have you tried with other browser also...? Would it be possible for you to restart the  Web server process. ( it will not impact to the production traffic through this firewall)

> debug software restart web-server

Thanks

[Register_Security]

Hi Hulk,

I really confuse with my device, I run debug software restart web-server , but it does not display any threat log

Thanks

[HULK]

You may contact PAN support for a deeper analysis.

Thanks

[Register_Security]

Hi Hulk,

After the "debug software restart web-server", the threat log was displayed again, but when I use custom report, it do not have any record in some days.

Have you ever seen the same problem ? share experience

Thanks,

[panos]

I had similar issue with system logs.

We solved that with clearing them all.

Not seen any about threat logs before.