Log Collector is error after upgrade OS version from 11.0.4-h2 to 11.1.x

[TungDS3]

I have an issue with Log collector ( local on Panorama server) after I upgrade OS version from 11.0.4-h2 to 11.1.2-h3 (and 11.1.2-h4) . The es on Log collector show status as “not running”.

- On active Panorama server:

+ See the Log collector ( local on active Panorama server) with the Health status as Green.

+ See the Log collector ( local on passive Panorama server) with the Health status as Red and es is shown as "not running".

- On passive Panorama server:

+ See the Log collector ( local on passive Panorama server) with the Health status as Green.

+ See the Log collector ( local on active Panorama server) with the Health status as Red and es is shown as "not running".

I have tried to restart elasticsearch and management-server on both 2 Panorama servers but still no luck.

Please help me to find the solution to resolve this issue ! Thanks !

[RodyDeLaRosa]

We are affected by the same bug. No resolution from PA yet.

[jmatanane]

11.0.4-h2 has been good to us. Just got done dealing with an issue where our 445s were sending duplicate logs to a syslog server with the same has values, timestamps, etc. Upgraded from 11.0.0-h3 to 11.0.4-h2 and the duplicate log issue went away as well as we were able to use radius once again. It's amazing how many bugs are in the OS's. Best of luck on remediating your issue. Have you considered rolling back to 11.0.4-h2?

[RodyDeLaRosa]

Something our CISO recommended for me going forward was to avoid any *.0.* version. They are usually the buggiest releases through and through. We unfortunately ran into an Elasticsearch bug going from 11.0.4-h1 to 11.1.4-h2, but it seems to be an issue with 11.0 and not 11.1. I would also recommend rolling-back as jmatanane suggested but be careful to do it during a maintenance window, if you run into the Elasticsearch bug going down to that version you will absolutely need TAC's support to get the logs working again. Tag me here if you run into any problems and I am happy to share insights from our experience getting our environment to stable state again. Good luck.