Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
07-22-2024 09:16 PM
I have an issue with Log collector ( local on Panorama server) after I upgrade OS version from 11.0.4-h2 to 11.1.2-h3 (and 11.1.2-h4) . The es on Log collector show status as “not running”.
- On active Panorama server:
+ See the Log collector ( local on active Panorama server) with the Health status as Green.
+ See the Log collector ( local on passive Panorama server) with the Health status as Red and es is shown as "not running".
- On passive Panorama server:
+ See the Log collector ( local on passive Panorama server) with the Health status as Green.
+ See the Log collector ( local on active Panorama server) with the Health status as Red and es is shown as "not running".
I have tried to restart elasticsearch and management-server on both 2 Panorama servers but still no luck.
Please help me to find the solution to resolve this issue ! Thanks !
10-15-2024 10:50 AM
We are affected by the same bug. No resolution from PA yet.
10-17-2024 01:02 PM
11.0.4-h2 has been good to us. Just got done dealing with an issue where our 445s were sending duplicate logs to a syslog server with the same has values, timestamps, etc. Upgraded from 11.0.0-h3 to 11.0.4-h2 and the duplicate log issue went away as well as we were able to use radius once again. It's amazing how many bugs are in the OS's. Best of luck on remediating your issue. Have you considered rolling back to 11.0.4-h2?
10-18-2024 08:57 AM
Something our CISO recommended for me going forward was to avoid any *.0.* version. They are usually the buggiest releases through and through. We unfortunately ran into an Elasticsearch bug going from 11.0.4-h1 to 11.1.4-h2, but it seems to be an issue with 11.0 and not 11.1. I would also recommend rolling-back as jmatanane suggested but be careful to do it during a maintenance window, if you run into the Elasticsearch bug going down to that version you will absolutely need TAC's support to get the logs working again. Tag me here if you run into any problems and I am happy to share insights from our experience getting our environment to stable state again. Good luck.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
