08-01-2022 12:13 PM - edited 08-01-2022 09:28 PM
Hello good afternoon, as always thanks for the support and collaboration:
I recently added a couple of Raid to m-100, as these were not configured, I made the settings at log setting level to send only configuration and system logs of the firewalls. At the configuration level, everything is fine, from panorama to the firewalls, so that the log setting has the Panorama checkbox, Device-Log-Settings, of system logs, as the configuration log, without filters in both cases, ie "All Log" in all of firewalls.
Everything is fine from the local configuration of the managed collector and the collector group. It appears in the Panorama gui as Connected and In sync, in green everything ok. all ready with the respective commit and push to the local collector. Although it is only one local collector, add the Device Log Forwarding list, all the firewalls and pointing to the local collector, the only one.
The issue is that in Panorama, I go to check the logs, I go to Monitor to the Log part "System" and "Configuration" I see nothing in Panorama, absolutely nothing ... I go to the firewall directly and if there are system and configuration logs.
I have already validated the connectivity and port issues and everything is ok without restrictions.
Infra-environment: Firewalls Pan-os 9.1.4 and M-100 Panorama.
What do you suggest to check, adjust, reboot, restart,etc ?
I remain attentive
Thank you, best regards
08-01-2022 06:42 PM
could you confirm that Panorama managed Firewalls are configured to send system and configuration logs to Panorama? Please refer in Firewall to Device > Log Settings > System/Configuration. Make sure that "Panorama" check box is selected.
08-01-2022 09:27 PM
Thank you for your response
Good evening, yes that is correct, this is also already configured in all the firewalls.
The log configuration has the Panorama, Device-Log-Settings checkbox, of the system logs, as of the configuration log, without filters in both cases, i.e. "All Log" in all of firewalls.
08-01-2022 11:34 PM
Thank you for reply @Metgatz
could you confirm in Panorama that Firewalls are sending System/Configuration logs?
Could you login to log collector, then issue: show logging-status device <Serial Number of one of the Firewall>
In the bottom part of the output, there should be entry for config and system logs with "Last Log Rcvd". If you see that logs are coming in, then the issue is within Panorama.
Could you also confirm that under: Collector Group > General > Log Storage > Log Storage Settings > Infrastructure and Audit Logs, there is allocated quota?
08-11-2022 06:47 PM
I have seen a similar thing after recently updating Panorama from 9.1 to 10.1. The update required a disk rebuilt to provide sufficient space. In Panorama, under monitor -> logs, there is no longer a system or configuration menu item
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!