PA410 Version: 10.2.7-h3 does not send logs to Panorama

[F.Pinar]

Hi team, 

I got a question , after upgrading Panorama to 10.2.7-h3 the logs stopped to be reflected on. (PA-410 to Panorama) ( from PA-3250 to Panorma is working properly). So , I proceed doing the following :

1. We proceeded with the workaround provided by https://live.paloaltonetworks.com/t5/general-topics/pa410-version-10-2-7-h3-does-not-send-logs-to-pa... which was not successful.
2. Compared the configuration of the PA-3250 with the PA-410 and checked 172.30.1.222 Primary NTP SERVER.
3. We make sure that the security policy is configured to log the end/login.
4. Run the >> show system setting logging command and observe the connection from the firewall to Panorama.
5. I check the disk space on the firewall >> show system disk-space
I suggested to run the following commands to restart the processes and the management server.
>> debug software restart process log-receiver
>> debug software restart process management-server
7. Unfortunately, it did not solve the issue and syslog logs have not been shown in Panorama.

8. I found out some bugs such as : PAN-218067, etc

My question is Do you think that if Version is upgraded 10.2.8 or 10.2.9 the issue can be solved ?

Any kind of help would be highly cherished.

[PavelK]

Hello @F.Pinar

thanks for post!

Could you confirm from Panorama's CLI that logs are coming in with this command: show logging-status device <serial number of PA-410> ?

Could you also confirm that Panorama and PA-410 have the same time / time zone? Different time between Panorama and Firewall might cause logs not to appear in GUI.

Regarding upgrade to 10.2.8 or 10.2.9, I went through release notes and I have not seen anything related under addressed issues, so I can't comment whether upgrade might be fix for this.

Kind Regards

Pavel