Traffic and Threats not visible in Panorama Monitor despite logs are send from FW to Panorama

[ArisDizdarevic]

It's a while since our system of 3 HA Palo Alto Firewalls stopped showing logs in Panorama. 

The logs are generated and forwarded to Panorama as in next two pictures:

Panorama-receiving logsOne of FW sending logsTraffic and Threats not visible

On one of webpages it was suggested we need additional license for wieving logs in Panorama? 

licenses

Summary:

Time is synchronized on Panorama and firewalls

Reseting log receiver on Panorama doesn't help (debug software restart process management-server)

We have no clue what to do next so any help would be appreciated.

[JoeAndreini]

What version of Panorama?

How long has panorama been up?

I experienced a similar issue in 7.1.10 and was told that it was probably related to a bug.  Restarting panorama fixes it for a few months at a time at my location.

[ArisDizdarevic]

Thanks for the answer,

As for Panorama version we have (also on all FW's we have the same softw. version):

Software Version

7.1.16

Unfortunally reseting the device did not solve the problem... There is still no traffic or threat info for the last 3 months... Firewalls generate logs o.k. and are viewable directly under FW, but Panorama somehow doesn't show them...

Perhaps is there a way to clear past traffic and threat logs on Panorama? Or somehowe restart collecting logs on Panorama and start over? Any idea how to do this?

Anyone else any suggestions?

[anuj_mor]

Have you followed this article?

https://live.paloaltonetworks.com/t5/Configuration-Articles/Palo-Alto-Networks-Firewall-not-Forwardi...

[OtakarKlier]

Hello,

Also make sure the FW's and the Panorama are on the same versions. The Panorama can be a higher version but same base code.

Panorama version 8.0.9 can manage FW version 8.0.1-9 but not 8.1.0.

Hope that makes sense.

Regards,

[anuj_mor]

It can 

---

@OtakarKlier wrote:

Hello,

Also make sure the FW's and the Panorama are on the same versions. The Panorama can be a higher version but same base code.

Panorama version 8.0.9 can manage FW version 8.0.1-9 but not 8.1.0.

Hope that makes sense.

Regards,

---

Panorama version 8.0.9 can manage 8.0.x or 7.x.x. 

"The Panorama can be a higher version but same base code." --> This is not a mandate.

[ArisDizdarevic]

I tried all options and solutions on link you gave me, but still no luck - still there are no new log entries from March this year.

Regarding versions - all versions are the SAME (on Panorama and on all the Firewalls in network).

Any other ideas?...

[OtakarKlier]

Hello,

I would call support and get their involvement.

Good luck.

[BigPalo]

Did you solve it?

[ArisDizdarevic]

The matter couldn't be solved by us, neither by level-2 support.

Finally level-3 support stepped in and only when they loged in "core-linux" on firewall they were able to determin the problem - the problem was to many inodes (https://en.wikipedia.org/wiki/Inode)

After level-3 cleanup all the logs and we set log-retention period to 5-months the situation was solved.

Hope this info helps you.

Br, Aris