"Number of hints on disk has exceeded 5000 due to log forward failures."

[RicardoNeira]

Hi,

I have a client (PA 5220 version 8.0.9) who continuously (every hour) is getting this error message in Monitor -> System: "Number of hints on disk has exceeded 5000 due to log forward failures."

At first we thought it was due to the parameter configured under Device -> Setup -> Management -> Logging and Reporting Settings -> Max Rows in User Activity Report since the value was 5000, but we are no longer sure

We also suspect that it was due to the maximum number of user authentication errors and / or external log elements and we limited the storage of this type of logs. But the alarm is still active

We do not know what is the origin of this error to be able to solve it and let it appear.

Some idea of ​​what is causing this error message and how to fix it.

[NetworkingKimitec]

Hi Jim, I'm in the same scenario.

Did you finally solve the problem and did you find the affectation of the hints?

thanks you in advance.

BR.

[MP18]

@NetworkingKimitec 

Please use below commands to fix the issue

debug software restart process log-receiver

delete log-collector preference-list

Regards

[NickoKristian]

Hi @MP18 ,

Would running these commands incur downtime on the services?

Regards

Nicko

[MP18]

@NickoKristianNickoKristian These commands are safe to run anytime.

Regards

[NetworkingKimitec]

I have executed the comands. but the problem persists:

any ideas?

Thank you in advance.

BR.

[MP18]

@NetworkingKimitecNetworkingKimitec What is the output of show logging status on the PA?

Where are you sending the logs external device?  Panorama or log collector?

Regards

[NetworkingKimitec]

Hi @MP18 ,

Here you can find the result of the command:

i have not setup any log to external device, just SNMP monitoring is currently setup.

Could it be associated to Agent-ID?

thank for your support.

BR.

[MP18]

@NetworkingKimitec If i am correct if logs are local to the Firewall, then you will not see any output from the above command.

As all the Logs are Local to the Firewall.

Regards

[NetworkingKimitec]

Hi @MP18 , so thats mean that is just cosmetic error or i should fix/do somethig more?

Thank you in advance.

BR.