gp logs sync with the passive but with time difference!

[Elmokadem]

Hello,

Logs should only be placed in the active node, however i am keep monitoring the globalprotect logs for 3 days and i am sure that the active node does not change, however the logs is still appears on both nodes each with different time.

Did some one noticed this ? PAN OS 9.1.3-h1

[reaper]

what kind of logs are you seeing?

[Elmokadem]

GP logs like (eventid eq gateway-logout) or (eventid eq gateway-getconfig)

i can see user logout activity logged on both active and passive but with time difference!!

system logs shouldn't be synced between HA peers as far as i know but it happens.

[reaper · Accepted solution]

User-ID information (user to IP mapping) is synced between peers however, and GP logon/logoff adds/deletes users to local user mapping

(in other words, the log isn't synced, the user mapping is updated, causing a log to be created)

[Elmokadem]

thanks for your reply . and is it normal to have time difference between the two databases ? like i have logout activity at certain time on active FW and mapping record with some delayed time like 1 minute in the passive FW 

[reaper]

yes, these are synced over to the peer which is not super critical so there can be a delay

sessions data is synced realtime over HA2, User-ID is synced over HA1 on intervals