export ike debug to syslog

[SeanHuff]

Hello,

We are having an intermittent tunnel issue. We have debug turned on in the ike logs and when I view them on the box I see all the debug logs. However, these rollover pretty fast and if the issue occurs and no one logs in to pull the logs within an hour or so then they are gone. We have set up a syslog server and the palo is sending logs to the syslog, but the ike logs being sent are standard/vanilla and not debug. Is anyone aware of how to send the ike debug logs to the syslog so we can have those logged/saved in our syslog?

[BPry · Accepted solution]

@SeanHuff,

You're talking about the actual process logs (less mp-log ikemgr.log)? I don't believe that this functionality exists at all natively in any way. I would script an export ('scp export log-file management-plane to user@host:path'  ) and just have the script adjust the path for each hour that you run the export. Then when it happens again you can actually go back and review it.

[SeanHuff]

I have a script running that has the palo scp over logs. They are, unfortunately, a large tarball (~115mb). Is there a way to just target the ikemgr log file and not grab everything. I'm filling up my 100gig vm pretty quickly. 

[BPry]

@SeanHuff,

Unfortunately, I don't believe that this functionality exists anymore. There used to be an option to export a single file, but modern PAN-OS forces you to grab the entire thing for some reason.