Global Protect pangps log messages - What to watch for

[BeejCyr]

Our company just finished a rollout of the Global Protect client to all of our locations.  Now we are getting occasional complaints about disconnects/reconnect and other assorted odd behaviour.  Much of this is just users looking for something to blame and out team is tasked with supporting the clients, but we were not involved in the set-up/configuration of the system.  Fortunately the client log level is set to debug and pangps and pangpa are quite verbose when it comes to logging at that level.  I have noticed that the messages all have a code assosiated with them and I was looking for either documentation on what the codes represent or some practical advice as to which messages to keep an eye out for.

For example:  Info code 760 indicates that the vpn timed out.   Debug code 5139 tells me that the client successfully connected to an internal gateway and 2533 to an external gateway.

So if I run

FindStr /C:"Debug(2533)" /C:"Debug(5139)" "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log"

I can get a list of each time the client connected.

[pulukas · Accepted solution]

Not aware of a master document for the log codes.

But this kb article nicely outlines a solid troubleshooting process on Global Protect issues.  It also collects all the common problems into one location with links to the remediation procedure.

https://live.paloaltonetworks.com/t5/Management-Articles/Troubleshooting-GlobalProtect/ta-p/75770