Help needed with pruning ikemgr.log outputs to show only interesting traffic log entries

Reply
Highlighted
L0 Member

Help needed with pruning ikemgr.log outputs to show only interesting traffic log entries

On Palo Alto CLI the only way I know of to see the logs of VPN tunnel Phase I errors etc is this command from inside the vsys via CLI where the VPN tunnel is built:

 

less mp-log ikemgr.log 

 

1) Are there commands for CLI where I can show just outputs for ONLY certain tunnel information that I'm seeking from the above log command? I've tried stuff like:

less mp-log ikemgr.log | grep www.xxx.yyy.zzz  (Peer IP address)

it returns with 'invalid syntax'

2) Can the entire ikemgr.log be exported?  That way I could pull the entire log and then search it for the interesting traffic I'm looking for.  But I need the commands for that too.

 

I am able to see some of the related traffic I want by running the command that's listed above to show the ikemgr log, and then putting in /www.xxx.yyy.zzz after the first page of log results are shown.  But that's not exactly what I'm needing.  The log file is gigantic and even just going through a single day of the entire log is not possible.

 

Any help/guidance/suggestions is all appreciated.

Thanks

Highlighted
Cyber Elite

Re: Help needed with pruning ikemgr.log outputs to show only interesting traffic log entries

@James_Cook,

There isn't a good way to export that file if this is something that you are doing on a daily basis, also I can't fathom why someone would need to do this on a daily basis. 

You can't simply export just this file, but it is included in a technical support file dump; so if you generate a tech-support file you'll be able to export that off of the firewall and then it will contain the ikemgr.log where you can filter it how you like. 

 

Personally I would simply stick to less and build a proper search for what you are looking for. So in the example that you gave you wouldn't actually want to use /www.xxx.yyy.zzz but utilize the search /www[.]xxx[.]yyy[.]zzz instead. Then hit enter to activate the search and you can use 'n' to go to the next result. Maybe that will help make searching through the log in the CLI a bit more usable for you. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!