Who Me Too'd this topic

Who Me Too'd this topic

L4 Transporter

Panorama LogDB issue after scp export/scp import

Hi all,

We had to extend the LogDB storage partition on our Panorama Virtual Appliance (ESXi) last Sunday. We followed the instructions in Panorama AdminGuide 6.1 ("Replace the Virtual Disk on a Panorama Virtual Appliance"):

  • Stopping of logging from all firewalls (using CLI command request log-fwd-ctrl device <serial number> action stop)
  • Exporting the LogDB to a Linux server (using CLI command scp export logdb to root@<IP of SCP server>:/<directory>/<file>)
  • Shutdown Panorama
  • Remoging the old virtual log-partition using VMware vSphere
  • Adding a new 2TB log-partition using VMware vSphere
  • Starting Panorama Virtual Appliance
  • <side note: as soon as the virtual appliance was up and running, buffered logs were automatically received from all firewalls and written to the - so far empty - logdb>
  • Importing the LogDB from a Linux server (using CLI command scp import logdb from root@<IP of SCP server>:/<directory>/<file>)
  • <side note: it looks like the import deleted the so far received buffered logs from the connected firewalls. We lost the traffic logs for the time when Panorama was down (bullet pt 3).>

The import took a while (maybe 2 hrs) and terminated successfully. However, when I search the traffic log for entries older than ~2 months back I don't get any results. For December last year I only get some entries from 14th December, but none for 13th or 15th December... What can we do to make those traffic logs available?

Thanks,

Oliver

Who Me Too'd this topic