gp logs sync with the passive but with time difference!

cancel
Showing results for 
Search instead for 
Did you mean: 

gp logs sync with the passive but with time difference!

L2 Linker

Hello,

 

Logs should only be placed in the active node, however i am keep monitoring the globalprotect logs for 3 days and i am sure that the active node does not change, however the logs is still appears on both nodes each with different time.

 

Did some one noticed this ? PAN OS 9.1.3-h1

1 ACCEPTED SOLUTION

Accepted Solutions

User-ID information (user to IP mapping) is synced between peers however, and GP logon/logoff adds/deletes users to local user mapping

(in other words, the log isn't synced, the user mapping is updated, causing a log to be created)

 

 

Tom Piens
PANgurus

View solution in original post

5 REPLIES 5

Cyber Elite
Cyber Elite

what kind of logs are you seeing?

Tom Piens
PANgurus

GP logs like (eventid eq gateway-logout) or (eventid eq gateway-getconfig)

i can see user logout activity logged on both active and passive but with time difference!!

 

system logs shouldn't be synced between HA peers as far as i know but it happens.

User-ID information (user to IP mapping) is synced between peers however, and GP logon/logoff adds/deletes users to local user mapping

(in other words, the log isn't synced, the user mapping is updated, causing a log to be created)

 

 

Tom Piens
PANgurus

thanks for your reply . and is it normal to have time difference between the two databases ? like i have logout activity at certain time on active FW and mapping record with some delayed time like 1 minute in the passive FW 

yes, these are synced over to the peer which is not super critical so there can be a delay

 

sessions data is synced realtime over HA2, User-ID is synced over HA1 on intervals

Tom Piens
PANgurus
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!