Where are the administrator access logs on Panorama?

[PeterT]

In Panorama where are the adminsitrator access logs? I.e. if I want to see when a adminsitrator user last accessed the system.  I know where that is on the PA firewalls, but on Panorama??

[PeterT · Accepted solution]

Found it in case anybody else ever runs into this.  The "Device Grouping" view also changes the left hand menu as well, I didn't realize it was contextual; only though the information displayed on the side was device grouping dependent.

So in my case I needed "All" because Panorama itself isn't a device which can be grouped

[Raido]

You don't see it in system log?

[reaper]

did you enable system log forwarding ?

[PeterT]

Raido: LOL I don' t even have that option on my Panorama system (though I do on my PA's):

[PeterT]

reaper: Yes though I assume it still keeps local logs (as I don' t have access to where the logs are actually forwarded to; don't ask, org politics)

[reaper]

Hi @PeterT then it would appear your admin account does not have access to these logs (physically or through the GUI)

your only recourse will be to use the context switch to look at the local logs on the firewall

Quis custodiet ipsos custodes ;)

[PeterT]

@reaper That makes no sense given I'm logged on as the "superuser" on the Panorama :) .. i.e. have rights to everything, I just don't have rights to the Arcsight SIEM where the remote logs are dumped ;) .  I should still be able to see the panorama local access logs though IMHO as would be a wierd situation where the panorama superuser could see the logs on the FW's (which I can) but not panorama itself

[reaper]

well that's awkward :p

ehm, what version of PAN-OS are you running? those log files should be there... can you try checking the CLI ?

> show log config direction equal backward
> show log system direction equal backward

[PeterT]

Panorama 8.0.2

Both work via CLI, the question then (per screenshot above) where is it via the Web UI?  I'm thinking possibly bug / call support on this one now lol.

[reaper]

yeah... if you're superuser those logs should be visible...

one last thing you could try (before calling support) is to 'reset' the gui : https://<panorama IP>/debug

once logged in, click the 'clear preferences' button, this will clear your admin's gui config, in case some flag got set