Logging stopped in Pan OS GUI

[bino150]

Hi all,

We had an issue today where we noticed the logging data stopped displaying in the Pan OS GUI (PA-500).. One thing we noticed is after committing a config change, it looks like the firewall was in the process of doing a sync with the backup device. I assume to resolve this problem we need to restart the dataplane? I'm surprised it allowed the commit to occur if a sync was in progress.

Bryan

[pulukas]

Logging is handled by the log receiver.

> debug software restart log-receiver

You can check statistics here to see which are not working.

>debug log-receiver statistics

[HULK]

Hello Bino,

Could you please check below mentioned command:

> show logging-status  >>>>>>>>>  Check last forwarded logs date and time

> debug log-receiver statistics  ------ check if below mentioned counters are incrementing

Log Forward discarded (queue full) count: 0  >>>>

Log Forward discarded (send error) count: 0  >>>>

>debug software restart log-receiver

if no change still;

>debug software restart management-server  ---- after applying this command, wait for a few minutes. It will log you out from CLI and GUI.

Thanks

[bino150]

Thanks Guys,

I assume the debug software restart log-receiver can be done while the firewall is up? We were thinking of waiting until after business hours do this. Any idea what would cause this issue? I assume maybe it was committing a change at the same time as the sync.

[HULK · Accepted solution]

Hello Bino,

Yes, you can run those 2 commands while the FW is UP. It would not impact to the data-plane traffic ( user's traffic through PAN firewall), because daemons are running on Management-plane. For safer side, you may restart log-receiver and management server process after the business hrs.

Thanks

[bino150]

Thanks Hulk

[HULK]

You are welcome.

[bino150]

Hulk we still seem to have an issue. I ran both debug software restart log-receiver which did not resolve the issue. Same with debug software restart management-server.

if I run debug log-receiver statistics I get the following error see dagger log. Do I need to do this plugged in to the cli port directly. I'm doign this via telnet from my workstation on the LAN.

[HULK]

Hello Bino,

If you restart the management-server daemon, you have to wait for a few minutes. It will automatically log out from CLI (SSH), since SSH/web-UI is managed by mgmt-server process. So, please re-login into the PAN firewall and then check with CLI command >debug log-receiver statistics

Thanks

[bino150]

Just logged in again and the error is still coming up. its been a few minutes now,

debug log-receiver statisitcs

Server error: An error occurred. See dagger.log for information.

[HULK]

Could you please check CLI command o/p of > show ntp

It should show the NTP server, it's connected.

Related DOC:

Error in NTP Sync Status Display

:

Let me know the result.

Thanks

[bino150]

Think I need to contact support for this. Thanks for the help

[HULK]

The mentioned error messages are related to NTP. Hence, could you please check the status of the NTP server on your FW.

Server error: An error occurred. See dagger.log for information

Thanks

[bino150]

Low and behold the log information is coming through now. I'm still getting the Server error: An error occurred. See dagger.log for information running debug log-receiver statistics from CLI though.

[bino150]

Interesting I am showing connected false for NTP

admin@PA-500(active)> show ntp

NTP state:

    NTP synched to LOCAL

    NTP server 0.north-america.pool.ntp.org connected: False

    NTP server 1.north-america.pool.ntp.org connected: False