Logging and Change Management in Prisma Cloud

[patriciar]

Summary:

• There is currently a size limit of 128kb in compute console history logs.
• It's likely to hit this limit and then only an error will display in the changes section: "diff size exceeded limit (128KB)".
• This makes the history log useless for auditing a specific endpoint, as experienced by multiple users.

Are there ways to overcome this issue in the short and long term? Consider upvoting the idea linked below.

Hoping to get this issue to the relevant teams as logging is essential for Prisma Cloud configuration and change management monitoring. Can we please have this idea reviewed by the appropriate team? 

Idea source: Fix Manage>Logs>History | Prisma Cloud New Features Request Portal (aha.io)

[Brandon_Wertz]

What is this related to as a function of Prisma?

[patriciar]

Hi Brandon - I'm looking at the audit logs available in Prisma Cloud Compute, under Manage -> View Logs.

As per documentation goes, 

"Administrative activity audit trail

All Prisma Cloud administrative activities are logged.

Changes to any settings (including previous and new values), changes to any rules (create, modify, or delete), changes to the credentials (create,modify, or delete), and all logon activity (success and failure) are logged. For every event, both the user name and source IP are captured."

Many of the log entries exceed the limit 128KB, which results in a log entry stating that fact. Do you know of a way to make these logs clearer?

Thanks

P

[Brandon_Wertz]

---

@patriciar wrote:

Hi Brandon - I'm looking at the audit logs available in Prisma Cloud Compute, under Manage -> View Logs.

As per documentation goes, 

"Administrative activity audit trail

All Prisma Cloud administrative activities are logged.

Changes to any settings (including previous and new values), changes to any rules (create, modify, or delete), changes to the credentials (create,modify, or delete), and all logon activity (success and failure) are logged. For every event, both the user name and source IP are captured."

Many of the log entries exceed the limit 128KB, which results in a log entry stating that fact. Do you know of a way to make these logs clearer?

Thanks

P

---

Oh ok...My company doesn't use Prisma Cloud so I can't speak to running into this issue, but if there's a config audit limit and it's not even 1MB that seems really small.