Hello,
I just had the same/similar issue and came across this thread, this was the solution for me:
Environment: Panorama managed Highly Available NGFWs. Scheduled Config Export via SCP working from Panorama, Scheduled Log Export not working from managed NGFWs.
Error: 'Failed exporting traffic log via ssh (last-calendar-day) to <target>
From the firewall CLI a manual SCP works fine:
scp export log traffic to <user>@<target>:/home/logman/palogs/<firewall>-20241218x start-time equal 2024/12/18@07:00:00 end-time equal 2024/09/18@09:00:00
<user>@<target>'s password: <password>
Marking log as exported successfully...
Solution:
From TechNote: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/device/device-scheduled-log-...
"If you use a Panorama template to configure the log export schedule, you must perform this step after committing the template configuration to the firewalls. After the template commit, log in to each firewall, open the log export schedule, and click Test SCP server connection."
I logged on to each individual firewall which had received the configuration from Panorama and executed the Test SCP server connection, which sure enough I had to accept the RSA key of the target ssh server (note: I had already accepted the RSA key using the CLI of each firewall, I didn't realize I also had to do this on the webgui.)
My SSH logs are now exporting properly again. Note that if you have HA firewalls, you will need to do the webgui RSA acceptance on each individual device.
