Panorama. howto retrive old logs ?

[ta185020]

Hi,

I have panoram installed and configured. I have my PA FW that is now sending traffic logs and system logs, and threat logs to the Panorama.

1. How can I configure PA FW to send URL logs to the Panorama ?? as I do not see any url logs in the panoram from the PA FW ?

2. Panoram is now reading the current logs, how can I export the existing 1 month old logs from PA FW to panorama ?

Please advise.

Rgds,

Tauseef

[skrall]

Tauseef,

Check your profile and make sure you are sending "Informational" and "Low" level events. I believe the URL filtering alerst are considered informational. Also make sure your URL catagories are configured for ALERT or BLOCK. ANything configured for allow will not be logged.

Steve Krall

[ta185020]

Hi Karl,

Thanks for this one, but my question was that when I had Panorama installed, already 40% logs were in the PA Firwall.

From the date I have configured the profile in PA for Panorama, all logs are being sent to the Panorama.

But the first 40% of logs that are in Palo Alto Firewall are still there in the same firewall.

How do I get the first 40% of these logs into the Panorama ??

[skrall · Accepted solution]

If you set up the firewall first and ran it for a a few weeks and then later installed Panorama then there is no way to export the old logs to Panorama. The best you can do is build a filter on the traffic monitor and then export to CSV but you will have to sift through this manually. You can submit this as a feature request if it is important to you.

Steve Krall

[ta185020]

Hi Karll,

How do I get the URL entries from the device to Panorama.

I know we have to set for 'informational or low', but its not working ! ((See attached log1)

I also tried creating a new rule and allowed only URL Alert, but still not working. (See Rule Alert)

Please advise.