Last shutdown/restart date

[BehzadTalsoleman]

Is there anyway to find out when a device was last shutdown?

Thanks,

[Remo]

There is an uptime value. Maybe this value helps in your situation.

--> Now - uptime = starttime of the firewall

But if the firewall was restarted then or if it simply was powered on you need to search in the systemlogs.

[reaper]

you can also look for eventid system-shutdown in the system log

( eventid eq system-shutdown )

[BehzadTalsoleman]

just out of curosity, is there an official cheatsheet where you found this on?

[reaper]

years and years of experience 😉

I do take requests, If you'd like some things documented 🙂

[BehzadTalsoleman]

I wish Palo had a cheatsheet for these useful commands. 

[theonewhoknocks]

Hi Reaper,

Do you have a list? Or is there a documentation? For the list of "event types" on system logs.

I only know the basics like, ha/vpn/system-shutdown.

[reaper]

the query builder will help you with that kind of information: 

so the list of 'types' in system log, at time of writing for PAN-OS 8.0 is:

• dhcp - dhcp server or client messages
• dnsproxy - dns proxy operations
• general - general messages (auto updates etc. )
• globalprotect - globalprotect messages
• hw - hardware related alerts
• ntpd - ntp update messages
• port - link state messages
• ras - RASMGR phase 1 & 2 messages
• routing - route daemon messages
• satd - globalprotect satelite messages
• sslmgr - sslvpn messages
• syslog - syslog forwarding messages
• url-filtering - URL filtering database messages
• userid - userID agent messages
• vpn - site to site vpn messages

[theonewhoknocks]

I never really used the query builder. Will try to use it more now. Thank you for this! Cheers!