GlobalProtect Client Log Dump Format

[Martin_Zichacek]

Hi,

I would like to parse and correlate multiple .log files from GP log dump.

Example log from PanGPS.log

(P5200-T7744)Debug(1916): 05/16/22 12:47:28:106 Send response to client for request hip-ack │
(P5200-T7744)Dump (11923): 05/16/22 12:47:28:106 Set m_bPreviousSwitchOffMsg to 0

 Do you know what are the types/meaning of the fields?

Thank you

[gshort]

There is so much data here that it can be hard to define in a single post.  What I would start with is the first number (P5200-T7744). These are the Process Identification Numbers (PID) of the service and threads that are running. The number after that (1916) is the command being sent.

In the PanGPS file for example you can look up the command 25 to see newly started threads. 

(P16240-T48584)Debug( 25): 06/26/24 09:07:22:689 create thread 0x5dc720 with thread ID 45612
(P6668-T16780)Debug( 25): 06/28/24 14:06:22:680 create thread 0xb18 with thread ID 39684

If you search for the ID then next line that contains the number it should give you an idea of what the thread is doing. Some threads will give the name of the process, but in the example of the gateway being checked it will not provide a name.

(P16240-T45612)Debug( 449): 06/26/24 09:07:22:689 VpnProcMonitor thread starts

(P6668-T39684)Debug(5717): 06/28/24 14:06:22:696 getaddrinfo host.GetString() xxx.gpcloudservice.com

So searching for the string in the first parenthesis will provide you what occurred during the life cycle of the thread.  Be aware that some threads will remain active through out the logs and so some data will be missing due to log roll-over.  Hope that helps some.