Hi all,
We had an issue today where we noticed the logging data stopped displaying in the Pan OS GUI (PA-500).. One thing we noticed is after committing a config change, it looks like the firewall was in the process of doing a sync with the backup device. I assume to resolve this problem we need to restart the dataplane? I'm surprised it allowed the commit to occur if a sync was in progress.
Bryan
Solved! Go to Solution.
Hello Bino,
Yes, you can run those 2 commands while the FW is UP. It would not impact to the data-plane traffic ( user's traffic through PAN firewall), because daemons are running on Management-plane. For safer side, you may restart log-receiver and management server process after the business hrs.
Thanks
Logging is handled by the log receiver.
> debug software restart log-receiver
You can check statistics here to see which are not working.
>debug log-receiver statistics
Hello Bino,
Could you please check below mentioned command:
> show logging-status >>>>>>>>> Check last forwarded logs date and time
> debug log-receiver statistics ------ check if below mentioned counters are incrementing
Log Forward discarded (queue full) count: 0 >>>>
Log Forward discarded (send error) count: 0 >>>>
>debug software restart log-receiver
if no change still;
>debug software restart management-server ---- after applying this command, wait for a few minutes. It will log you out from CLI and GUI.
Thanks
Thanks Guys,
I assume the debug software restart log-receiver can be done while the firewall is up? We were thinking of waiting until after business hours do this. Any idea what would cause this issue? I assume maybe it was committing a change at the same time as the sync.
Hello Bino,
Yes, you can run those 2 commands while the FW is UP. It would not impact to the data-plane traffic ( user's traffic through PAN firewall), because daemons are running on Management-plane. For safer side, you may restart log-receiver and management server process after the business hrs.
Thanks
Thanks Hulk
You are welcome. :smileyhappy:
Hulk we still seem to have an issue. I ran both debug software restart log-receiver which did not resolve the issue. Same with debug software restart management-server.
if I run debug log-receiver statistics I get the following error see dagger log. Do I need to do this plugged in to the cli port directly. I'm doign this via telnet from my workstation on the LAN.
Hello Bino,
If you restart the management-server daemon, you have to wait for a few minutes. It will automatically log out from CLI (SSH), since SSH/web-UI is managed by mgmt-server process. So, please re-login into the PAN firewall and then check with CLI command >debug log-receiver statistics
Thanks
Just logged in again and the error is still coming up. its been a few minutes now,
debug log-receiver statisitcs
Server error: An error occurred. See dagger.log for information.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!