Panorama Legacy to Panorama mode Log Migration

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Panorama Legacy to Panorama mode Log Migration

L1 Bithead

I just completed moving a Panorama VM from Legacy mode to Panorama mode.  Panorama is running 9.1.14-h4.

What I'm concerned about are the existing logs.  From a document I read, you needed to run the following command

request logdb migrate vm start

then run

request logdb migrate vm status

to check the status.  When it's done it should show "migration has been done"

The problem is, the migration showed no logs actually being migrated!  Here's the output:

 

<username>@panorama-01> request logdb migrate vm status

migration has been done

'traffic' is done. 0 records migrated.
'config' is done. 0 records migrated.
'system' is done. 0 records migrated.
'threat' is done. 0 records migrated.
'appstat' is done. 0 records migrated.
'event' is done. 0 records migrated.
'alarm' is done. 0 records migrated.
'hipmatch' is done. 0 records migrated.
'userid' is done. 0 records migrated.
'iptag' is done. 0 records migrated.
'mdm' is done. 0 records migrated.
'extpcap' is done. 0 records migrated.
'gtp' is done. 0 records migrated.
'auth' is done. 0 records migrated.
'sctp' is done. 0 records migrated.
'globalprotect' is done. 0 records migrated.

 

When I go to the 'Monitor' tab and do a search by date nothing comes up (here's a search example:  ( time_generated leq '2022/08/21 13:20:19' ) ).  If I just start scrolling through the pages of the logs I do finally get to logs that existed before the migration was performed.

 

So:

1. Were the logs automatically migrated / moved to the new log location (the 2TB datastore)?

2. Does Panorama need time to re-index after the migration from Legacy to Panorama mode or the search bar parameters to work properly?

 

Thanks in advance.

1 REPLY 1

L1 Bithead

Yep.  Did that and the Managed Collector shows "in sync" and "last commit succeeded."  It honestly looks healthy.

 

My issue is that when I logdb migration it showed nothing being migrated and this seems wrong.

I just did another search for older logs but found it only showed 3 days worth.

From the cli command 'show log-collector serial-number' that detailed storage and summary storage are limited to 3 days and I'm not sure where to change this. 

  • 1391 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!