Panorama LogDB issue after scp export/scp import

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Panorama LogDB issue after scp export/scp import

L4 Transporter

Hi all,

We had to extend the LogDB storage partition on our Panorama Virtual Appliance (ESXi) last Sunday. We followed the instructions in Panorama AdminGuide 6.1 ("Replace the Virtual Disk on a Panorama Virtual Appliance"):

  • Stopping of logging from all firewalls (using CLI command request log-fwd-ctrl device <serial number> action stop)
  • Exporting the LogDB to a Linux server (using CLI command scp export logdb to root@<IP of SCP server>:/<directory>/<file>)
  • Shutdown Panorama
  • Remoging the old virtual log-partition using VMware vSphere
  • Adding a new 2TB log-partition using VMware vSphere
  • Starting Panorama Virtual Appliance
  • <side note: as soon as the virtual appliance was up and running, buffered logs were automatically received from all firewalls and written to the - so far empty - logdb>
  • Importing the LogDB from a Linux server (using CLI command scp import logdb from root@<IP of SCP server>:/<directory>/<file>)
  • <side note: it looks like the import deleted the so far received buffered logs from the connected firewalls. We lost the traffic logs for the time when Panorama was down (bullet pt 3).>

The import took a while (maybe 2 hrs) and terminated successfully. However, when I search the traffic log for entries older than ~2 months back I don't get any results. For December last year I only get some entries from 14th December, but none for 13th or 15th December... What can we do to make those traffic logs available?

Thanks,

Oliver

0 REPLIES 0
  • 2427 Views
  • 0 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!