12-03-2021 12:18 AM
The hours in which events appear in the Paloalto log do not correspond to reality. They appear several hours after they have occurred.
We have checked that it is not a problem with the NTP, this seems to be a problem with the time at which Paloalto shows the sessions.
Does anyone know what could be the cause of this delay?
12-03-2021 01:03 AM
Hi @Alpalo ,
- Let begin with something simple - What timezone are you using and what timezone is the firewall configured?
- You mentioned you have checked the NTP, but have you confirm FW can reach the NTP? Under CLI run "show ntp" and status should say "synched"
- It is important to note, how the firewall is configured to log the traffic. Is it at the end of the session, at the start or both. This setting is configured separately for each rule and by default it is set to log at session end. This means that if you have long life sessions, you will not see any log event until the session is closed. Even if session is running for days, you will see log entry only when the session is closed.
- It is important also to note, that each traffic log entry has three timestamps recorded: actuall session start, actuall session end, and log genered time. If you check the "start time", does it correspond to the time you expect to see?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
