Log Forwarding - Traffic Works, Others Do Not

[DavidSink]

I have to be missing something simple, for forwarding logs to a collection server. I can get the traffic logs, no issues, but all the other logs, will not send (Threat, Wildfire...). Do the other logs need some kind of special forwarding, or permissions in the OS? I have all the log types set in one section of the Objects->Log Forward, i am also sending via UDP 514.

to me all should be good, since i can see and get the Traffic logs, with no issues, but no other logs will come through, just an odd issue for me.

PA-820 with 10.0.2 OS.

[PavelK]

Hello @DavidSink

thanks for posting!

PAN-OS 10.0 you are running is end of life. I would recommend to follow upgrade path to at least 10.1: Determine the Upgrade Path to PAN-OS 10.1 or newer.

There is no special configuration for threat logs. Could you confirm you can see logs locally in Firewall? Could you check point No.4 of this KB: How to troubleshoot firewall or Panorama log queue issues? Could you also try restarting logging service: "debug software restart log-receiver"?

Kind Regards

Pavel 

[DavidSink]

Thanks Paval, i went through the info, and nothing worked. i did however, do a bit of digging through some commands, and found an issue maybe. When i ran "debug log-receiver fwd show" thinking i would maybe see an error, or oddity, it replied "Log fwding from log receiver is not enabled". does this mean that forwarding is turned off, so all the logs with the exception of traffic, will not go outbound? if that is true, forwarding is off then how does/why traffic log goes out?

About the OS, we have new devices with the newest OS ready to get racked, but want to get this going so we do not have a bunch junk in a clean install.

Dave

[PavelK]

Hello @DavidSink

thank you for reply.

The message you got looks like expected. I checked the same in multiple Firewalls that are sending logs without any issue and got the same output.

- Could you try to restart management process: How to Restart the Management server "mgmtsrvr" Process?

- Are you using any log forwarding filter under: Object > Log Forwarding > [Profile Name] > Log Type Threat > Filter?

Kind Regards

Pavel 

[AddysonFord]

Thank you.