gp logs sync with the passive but with time difference!

Reply
Highlighted
L1 Bithead

gp logs sync with the passive but with time difference!

Hello,

 

Logs should only be placed in the active node, however i am keep monitoring the globalprotect logs for 3 days and i am sure that the active node does not change, however the logs is still appears on both nodes each with different time.

 

Did some one noticed this ? PAN OS 9.1.3-h1


Accepted Solutions
Highlighted
L7 Applicator

User-ID information (user to IP mapping) is synced between peers however, and GP logon/logoff adds/deletes users to local user mapping

(in other words, the log isn't synced, the user mapping is updated, causing a log to be created)

 

 

Tom Piens - PANgurus.com
Find my book at amazon.com/dp/1789956374

View solution in original post


All Replies
Highlighted
L7 Applicator

what kind of logs are you seeing?

Tom Piens - PANgurus.com
Find my book at amazon.com/dp/1789956374
Highlighted
L1 Bithead

GP logs like (eventid eq gateway-logout) or (eventid eq gateway-getconfig)

i can see user logout activity logged on both active and passive but with time difference!!

 

system logs shouldn't be synced between HA peers as far as i know but it happens.

Highlighted
L7 Applicator

User-ID information (user to IP mapping) is synced between peers however, and GP logon/logoff adds/deletes users to local user mapping

(in other words, the log isn't synced, the user mapping is updated, causing a log to be created)

 

 

Tom Piens - PANgurus.com
Find my book at amazon.com/dp/1789956374

View solution in original post

Highlighted
L1 Bithead

thanks for your reply . and is it normal to have time difference between the two databases ? like i have logout activity at certain time on active FW and mapping record with some delayed time like 1 minute in the passive FW 

Highlighted
L7 Applicator

yes, these are synced over to the peer which is not super critical so there can be a delay

 

sessions data is synced realtime over HA2, User-ID is synced over HA1 on intervals

Tom Piens - PANgurus.com
Find my book at amazon.com/dp/1789956374
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!