Logging - 5450

[clewis1]

Any tips/places to look into when not seeing logs locally on the firewall? new install, PAN OS 10.2.7

[PavelK]

Hello @clewis1

could you check this KB: PA 5400 - No logs seen on the firewall including Traffic, URL filtering, Threat logs etc to see you are facing the same issue?

Kind Regards

Pavel

[clewis1]

Thank you for the reply, we had seen this article too. Unfortunately this is not the fix for us. Still no logs.

[PavelK]

Hello @clewis1

thank you for reply.

Could you please confirm what logs you are not seeing? All logs including system logs or only traffic logs?

Kind Regards

Pavel

[clewis1]

Not seeing Threat, Traffic, or URL.

System and config are there

[PavelK]

Hello @clewis1

thank you for reply.

For Traffic and Threat logs could you make sure that all policies have logging enabled: Session Log Best Practices. Also note that you have to override setting for default policies: How to See Traffic from Default Security Policies in Traffic Logs.

For URL logs, you have to set action to alert to see logs: URL Filtering Profiles.

Kind Regards

Pavel 

[clewis1]

Hardware startup guide was missing a step.

>request logdb-migrate logging-drive start

This command will do the following
-will migrate from system drive to logging drive
-remove setting/management/quota-settings/disk-quota from running-config.xml and templates
-update configuration schema to switch from disk-quota (single-disk) to chassis-quota (multi-disk)
-reboot the FW so the updated configuration schema will take effect.

After running this, we now have logs