gp logs sync with the passive but with time difference!

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Reply
melmokad
L1 Bithead

gp logs sync with the passive but with time difference!

Hello,

 

Logs should only be placed in the active node, however i am keep monitoring the globalprotect logs for 3 days and i am sure that the active node does not change, however the logs is still appears on both nodes each with different time.

 

Did some one noticed this ? PAN OS 9.1.3-h1


Accepted Solutions
reaper
L7 Applicator

User-ID information (user to IP mapping) is synced between peers however, and GP logon/logoff adds/deletes users to local user mapping

(in other words, the log isn't synced, the user mapping is updated, causing a log to be created)

 

 

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374

View solution in original post


All Replies
reaper
L7 Applicator

what kind of logs are you seeing?

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374
melmokad
L1 Bithead

GP logs like (eventid eq gateway-logout) or (eventid eq gateway-getconfig)

i can see user logout activity logged on both active and passive but with time difference!!

 

system logs shouldn't be synced between HA peers as far as i know but it happens.

reaper
L7 Applicator

User-ID information (user to IP mapping) is synced between peers however, and GP logon/logoff adds/deletes users to local user mapping

(in other words, the log isn't synced, the user mapping is updated, causing a log to be created)

 

 

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374

View solution in original post

melmokad
L1 Bithead

thanks for your reply . and is it normal to have time difference between the two databases ? like i have logout activity at certain time on active FW and mapping record with some delayed time like 1 minute in the passive FW 

reaper
L7 Applicator

yes, these are synced over to the peer which is not super critical so there can be a delay

 

sessions data is synced realtime over HA2, User-ID is synced over HA1 on intervals

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!