Upgrading 7.1 to 8.0: New Log Storage

Reply
RSporbert
L1 Bithead

Upgrading 7.1 to 8.0: New Log Storage

Hi


We are upgrading to 8.0 and have noticed the cavet about new log storage in 8.0. We do not have log collectors setup, but are collecting logs in Panorama (threat and traffic only) and wonder if the existing log migration applies to these as well?

 

Thanks in advance for any advice,

Rebecca

 


Accepted Solutions
jdelio
Community Team Member

@RSporbert Rebecca, 

Even though you do not have a seperate log collector in Panorama, you will have a built in log collector by default, otherwise Panorama would not be able to access the logs from the Palo Alto Networks devices sending the logs to Panorama.

 

Because PAN-OS 8.0 uses a new format, the logs will need to be converted to the new format to work properly and run reports.

 

For instructions on how to accomplish this, please see this page:

Upgrade Firewalls Using Panorama

 

I hope this answers your question.

LIVEcommunity team member
Stay Secure,
Joe
Don't forget to Like items!

View solution in original post


All Replies
jdelio
Community Team Member

@RSporbert Rebecca, 

Even though you do not have a seperate log collector in Panorama, you will have a built in log collector by default, otherwise Panorama would not be able to access the logs from the Palo Alto Networks devices sending the logs to Panorama.

 

Because PAN-OS 8.0 uses a new format, the logs will need to be converted to the new format to work properly and run reports.

 

For instructions on how to accomplish this, please see this page:

Upgrade Firewalls Using Panorama

 

I hope this answers your question.

LIVEcommunity team member
Stay Secure,
Joe
Don't forget to Like items!

View solution in original post

RSporbert
L1 Bithead

Thank you jdelio, upgraded successfully and all good. 

Fengrui
L2 Linker

Hi Joe @jdelio,

 

We have a panorama(VM) with 2x M-100 log collectors, to upgrade to 8.0, here is my plan,

 

1. Upgrade both Panorama and log collectors to 8.0, confirm they are working, e.g. new logs are showing fine.

2. Start the old log migration with the following command.

    PA>request logdb migrate lc serial-number<serial_number> start

 

My question is on the 2nd step, where do I run this command from, is it from Panorama or LC? If it's panorama, I guess the serial_number is one of the log collectors?

 

Thanks, Fengrui

 

jdelio
Community Team Member

@Fengrui

That second command would be ran on Panorama CLI. More specifically, it would be ran on the Log Collector. 

If you do not have a seperate log collector, then you would just be on Panorama CLI directly to run this command.

 

I hope this makes sense.

 

For more information about upgrading to PAN-OS 8.0, please see this link:

https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/upgrade-to-pan-os-8-0/upgr...

LIVEcommunity team member
Stay Secure,
Joe
Don't forget to Like items!
Fengrui
L2 Linker

 @jdelio Thanks Joe, we do have dedicated log collector, so the serial number in the command would be from one of the firewalls sending logs to the collector? And this means I will need to convert log for each firewall?

jdelio
Community Team Member

@Fengrui,

The command is:

> request logdb migrate lc serial-number<serial_number> start

 

So, I would say that the serial # is the actual Log Collector serial #.. 

 

Also, after looking at this again, this command would be run on Panorama CLI..  just wanted to clarify..  As Panorama talks with 1 or more Log Collectors. 

LIVEcommunity team member
Stay Secure,
Joe
Don't forget to Like items!
Fengrui
L2 Linker

@jdelio, thanks Joe.

howardtopher
L2 Linker

I just upgraded our panorama to 8.0.2.  We don't have any external log collectors and only store logs locally on panorama.  I'm don't seem to be able to start the log migration process.  The error it gives is the serial numer is invalid.  I'm using the panorama serial number in the command.  Am I doing something wrong?  Do I have to convert to "panorama mode" first?

 

> request logdb migrate lc serial-number xxxxxxxxxxx start

Server error :  xxxxxxxxxxx is invalid serial-number.Current target-vsys is none
 request -> logdb -> migrate -> lc -> serial-number is invalid

jdelio
Community Team Member

@Fengrui@howardtopher and If you do not have a seperate log collector on Panorama, I was able to find the following talking about this here:

https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/panorama-features/logging-...

 

This link talks specifically about the Logging enhancements in PAN-OS 8.0.

 

I talks about upgrading the logs locally on Panorama first, with lots of instructions. So Please read that first, as it should help explain what is going on and what needs to happen next.  There is also another command to run, AFTER upgrading the logs.

> request logdb migrate vm start

 

Please let us know if you have any additional questions about this.

LIVEcommunity team member
Stay Secure,
Joe
Don't forget to Like items!
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!