Thank you for the post @future
troubleshooting Panorama missing logs is complex and requires more input from your side.
First thing, could you confirm what PAN-OS version you are running on Firewall? If you are in 9.1 release, then I would recommend upgrade to 9.1.14. In this version there is a bug fix: PAN-185616
I confirmed with TAC that this is not only limited to syslog, but also affects sending logs to Panorama.
Could you also check Panorama log collector side to confirm from CLI whether there are any Fails:
debug log-collector log-collection-stats show incoming-logs | match Fails
If the number of Fails is anything other than 0, this indicates that some logs are failing to be written to disks.
Could you also confirm what PAN-OS version you are running on Panorama and whether you are using dedicated log collectors or local log collector.
Kind Regards
Pavel
