One of our customer facing issue that unable to see recent traffic logs for particular source and destination in gui. But we could see the live session on cli by the command "show session all filter source 192.168.x.X destination 172.17.X.X".
Session working as expected. but we need to see the traffic logs on gui. restarted the mgmt server but no luck. anyone facing this kind of issue. please share your thoughts
Hi @MohammedAsik ,
Just to confirm again, Is it happening for given specific source & IP addresses or you're not able to see traffic logs for all the traffic? If this is for only specific source & destination, please check if Log at Session Start and/or Log at Session End is enabled under Security Policy which is allowing this traffic. At least, Log at Session End should be is selected.
Hope it helps!
Yes, Its happening only for specific source and destination. log session end and start were enabled on security policy.
One more time I explain you clearly. I have one security rule that contains 5 source ips from trust zone and one destination ip from another local zone. For 2 src IPs we haven't see the logs in Gu but for other 3 Ip's we are able see the logs which are in same security rule.
For those 2 src IP's traffic logs were received one day before.
Is there any process need to restart to to fix this issue ?
We recently ran into a bug where the Palo was not logging some traffic if it hit a rule that did not have Zones defined. Does your security rule happen to not have Zones defined?
I have found the issue. Old session not get deleted. After I cleared the existing session ID by clear session id, firewall creates the new session and its created the logs in GUI
Now issue has been resolved. Thank you all
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!