Log Forwarding to Panorama Not Working

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Log Forwarding to Panorama Not Working

L1 Bithead

So apparently I must be missing something.  I configured Log Forwarding to send it to my Panorama instance, so that when I click on Monitor I can click and view the logs but apparently none of my logs are showing up in Panorama.  They show up find on the firewalls but not in Panorama.  


I have made sure that all my Log Forwarding profiles have it checked to send to Panorama.  The device setup shows it's connected to the correct IP address for the Panorama.  I thought that was the two main steps you had to be (besides commiting) but I went ahead and even tried to add it to the Zones for the log setting.  I also made sure it was set up in the Policies > Security as well for the events that are getting tripped.  I am still not seeing any logs in Panorama.


Is there something else I should try or am I missing something?


I have log collectors, so do not know if that is expected when forwarding directly to Panorama.  I can check that out in my lab tonight.


Did you check the logging-status on teh device and in panorama?  if not, check them anyway, they may give more information.

So all the Log Forwarding was set to send it to a Splunk instance, which they say is working, but the log forwarding doesn't seem to send to Panorama.  I verfied all the checkboxes were set properly but I am at a loss.  

Alright so this is from one of my firewalls that I have verified that everything is checked.  I even checked a working instance as well and they all seem to match up well.


The one is the firewall and the other the panorama.





Any suggestions? 😄

L1 Bithead

I am facing the same issue. No output when running "show logging-status" and show log-collector preference list". log forwarding is configured to forward logs to Panorama. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!