This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About JeffKim
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About JeffKim
09-14-2023
25Posts
3Likes
1Solution
Sep 14, 2023Last Visited
User
Activity
User
Profile
Latest posts by JeffKim
| Subject | Views | Posted |
|---|---|---|
| 1785 | 08-31-2022 06:43 AM | |
| 2099 | 05-02-2022 06:52 PM | |
| 2129 | 05-02-2022 08:18 AM | |
| 1239 | 04-08-2022 09:08 AM | |
| 2362 | 03-22-2022 03:59 PM | |
| 1203 | 01-31-2022 12:03 PM | |
| 1268 | 01-28-2022 08:23 AM | |
| 2146 | 01-18-2022 07:44 PM | |
| 2184 | 01-18-2022 09:27 AM | |
| 3281 | 01-14-2022 02:24 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 01-04-2022 12:28 PM | |
| 2 Likes | 01-04-2022 06:45 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 9 Likes | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 04-26-2017 12:04 PM |
| Date Last Visited | 09-14-2023 07:31 PM |
| Posts | 25 |
| Total Likes Received | 3 |
08-31-2022
06:43 AM
when we had the issue , there was no other way to recover faulty panorama as soon as possible. the minimum master node is n/2 + 1. we need 3 log collectors to avoid this issue. we still use two log collectors.
... View more
05-02-2022
08:18 AM
Thanks Rxie ,
In case of mine , I have never seen over than 16 days .
Slot:2 Quotas: detailed: 60.00%, 282 GB Expiration-period: 30 days summary: 30.00%, 141 GB Expiration-period: 30 days infra_audit: 5.00%, 24 GB Expiration-period: 30 days platform: 0.10%, 0 GB Expiration-period: 30 days external: 0.10%, 0 GB Expiration-period: 30 days
Disk usage: detailed: Logs: 136903 MB, Current Retention: 14 days summary: Logs: 22788 MB, Current Retention: 25 days infra_audit: Logs: 1488 MB, Current Retention: 1 days platform: Logs: 0 MB, Current Retention: 0 days external: Logs: 0 MB, Current Retention: 0 days
Space reserved for cores: 0MB
/dev/sdb1 1.7T 1.1T 560G 67% /opt/panlogs/ld1 /dev/sdd1 1.7T 903G 749G 55% /opt/panlogs/ld3 /dev/sdc1 1.7T 904G 748G 55% /opt/panlogs/ld2
... View more
04-08-2022
09:08 AM
Do you check how do you setup logging period ? In Monitor>traffic , top of right corner , you can filter last 15 mins, hours , 24 hours etc ...
Run cli , show log-collector-es-cluster health , show us what do you see /..
... View more
03-22-2022
03:59 PM
Hi we have 2 panorama and it has virtual disks for log-collector.
I have checked log-collector-es-cluster health and it is green.
1 collector-group and 2 log-collectors
When i run cli
show system logdb-quota at the active panorama , i get result as below
How can I understand expiration-period is 30 days , but I can't see more than 16 days
Is it disk volume issue ? IMHO , it looks overwrite traffic log older than 16 days
Quotas: system: 8.00%, 1.072 GB Expiration-period: 7 days config: 8.00%, 1.072 GB Expiration-period: 7 days hip-reports: 1.00%, 0.134 GB Expiration-period: 0 days appstat: 5.00%, 0.670 GB Expiration-period: 0 days
Disk usage: system: Logs and Indexes: 844.9MB Current Retention: 7 days config: Logs and Indexes: 28.8MB Current Retention: 7 days appstatdb: Logs and Indexes: 691.5MB Current Retention: 20 days hip-reports: Logs and Indexes: 0 Current Retention: 0 days
Slot:0 Quotas: detailed: 60.00%, 282 GB Expiration-period: 30 days summary: 30.00%, 141 GB Expiration-period: 30 days infra_audit: 5.00%, 24 GB Expiration-period: 30 days platform: 0.10%, 0 GB Expiration-period: 30 days external: 0.10%, 0 GB Expiration-period: 30 days
Disk usage: detailed: Logs: 137161 MB, Current Retention: 14 days summary: Logs: 21456 MB, Current Retention: 27 days infra_audit: Logs: 1425 MB, Current Retention: 21 days platform: Logs: 0 MB, Current Retention: 0 days external: Logs: 0 MB, Current Retention: 0 days
Slot:1 Quotas: detailed: 60.00%, 282 GB Expiration-period: 30 days summary: 30.00%, 141 GB Expiration-period: 30 days infra_audit: 5.00%, 24 GB Expiration-period: 30 days platform: 0.10%, 0 GB Expiration-period: 30 days external: 0.10%, 0 GB Expiration-period: 30 days
Disk usage: detailed: Logs: 137103 MB, Current Retention: 14 days summary: Logs: 22017 MB, Current Retention: 27 days infra_audit: Logs: 1403 MB, Current Retention: 21 days platform: Logs: 0 MB, Current Retention: 0 days external: Logs: 0 MB, Current Retention: 0 days
Slot:2 Quotas: detailed: 60.00%, 282 GB Expiration-period: 30 days summary: 30.00%, 141 GB Expiration-period: 30 days infra_audit: 5.00%, 24 GB Expiration-period: 30 days platform: 0.10%, 0 GB Expiration-period: 30 days external: 0.10%, 0 GB Expiration-period: 30 days
Disk usage: detailed: Logs: 137118 MB, Current Retention: 14 days summary: Logs: 21723 MB, Current Retention: 27 days infra_audit: Logs: 1401 MB, Current Retention: 21 days platform: Logs: 0 MB, Current Retention: 0 days external: Logs: 0 MB, Current Retention: 0 days
Space reserved for cores: 0MB
... View more
01-31-2022
12:03 PM
It was my bad ... It almost matched
I had checked traffic log set up with last 7 days ... After I have changed it to last 30 days , I can see traffic log as I expected .
... View more
01-28-2022
08:23 AM
Anyone tell me what the day mean in Managed collector > statistics > oldest log ?
I just checked the day and I found something is weird.
1) when I checked it less than 7 days , it almost matched with current local times
2) And oldest log day is increased a day per day , but i can't see traffic log over 8 days from current local time.
... View more
01-18-2022
07:44 PM
Hi Deepak25,
Did you deploy 3rd LC in your environment?
Could you share your experience ? How could you deploy it and what's the benefit of 3rd LC ...
... View more
01-18-2022
09:27 AM
Hi Steve,
How do we ponting to CG , not LC1 or LC2 ?
We are forwarding log to Panorama , Those are HA mode and LC1 is primary and LC2 is secondary Panorama and we have one CG.
... View more
01-14-2022
02:24 PM
Working with Paloalto support and we found the root cause is ElasticSearch doesn't work between log-collectors.
We couldn't fixed the issue and need to clarify it .
... View more
01-13-2022
05:02 PM
1. Yes
2.Yes
3.
Log Collector 'Log Collection log forwarding agent' is active and connected to 10.93.9.54
config Not Available Not Available 0 0 0 system 2022/01/13 14:28:19 2022/01/13 16:46:25 2971756 2971746 4015 threat 2022/01/13 14:27:25 2022/01/13 16:46:25 1766377018 1766377008 2448368 traffic 2022/01/13 14:36:52 2022/01/13 16:48:07 1534220641 1534210553 11715931 hipmatch Not Available Not Available 0 0 0 gtp-tunnel Not Available Not Available 0 0 0 userid 2022/01/13 14:21:37 2022/01/13 16:46:25 169621989 169621979 569726 iptag Not Available Not Available 0 0 0 auth Not Available Not Available 0 0 0 sctp Not Available Not Available 0 0 0 globalprotect 2022/01/13 14:20:13 2022/01/13 16:46:25 3114386 3114376 24217
~ ~
... View more
01-13-2022
04:32 PM
jkim3@lvnv-now-mgt-pan(secondary-active)> show log-collector all
Serial CID Hostname Connected Config Status SW Version IPv4 - IPv6 --------------------------------------------------------------------------------------------------------- 000710xxxxx 2 esca-now-mgt-pan no Out of Sync 10.1.3-h1 10.53.9.54 - unknown
Redistribution status: none Last commit-all: none, current ring version 3 SearchEngine status: Active md5sum updated at 2022/01/13 14:01:27
Certificate Status: Certificate subject Name: 0e070ba7-7aec-4663-ab53-7a2ea571fec6 Certificate expiry at: Connected at: Custom certificate Used: Last masterkey push status: Unknown Last masterkey push timestamp: none
Serial CID Hostname Connected Config Status SW Version IPv4 - IPv6 --------------------------------------------------------------------------------------------------------- 00071xxxxx 5 lvnv-now-mgt-pan yes In Sync 10.1.3-h1 10.93.9.54 - unknown
Redistribution status: none Last commit-all: commit succeeded, current ring version 3 SearchEngine status: Inactive md5sum updated at ?
Certificate Status: Certificate subject Name: Certificate expiry at: none Connected at: none Custom certificate Used: no Last masterkey push status: Unknown Last masterkey push timestamp: none
... View more
01-13-2022
04:25 PM
We have two panorama and HA.
Today our active panorama was broken caused by VM datastore issue .
Secondary Panorama taken active role , but We can't see any traffic log at the Monitor tab.
... View more
01-05-2022
08:16 AM
@LCMember20111
We are using Panorama VA
one Collector group and two collectors .
https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/manage-log-collection/log-collection-deployments/deploy-panorama-virtual-appliances-with-local-log-collectors.html
... View more
01-04-2022
06:45 PM
2 Kudos
We got error as below.
2022-01-04 11:27:24.878 -0800 connection failed for err 111 with vld-0-0. Will start retry 32 in 2000 2022-01-04 11:27:24.878 -0800 connection failed for err 111 with vld-1-0. Will start retry 32 in 2000 2022-01-04 11:27:24.878 -0800 connection failed for err 111 with vld-2-0. Will start retry 32 in 2000 2022-01-04 11:27:25.457 -0800 Error: _pkt_process(pkt.c:1486): vld for segnum 45 not set or not connected. dropping pkt 2022-01-04 11:27:25.457 -0800 Error: _handle_read_event(pkt.c:3543): Error processing read pkt on fd:16 cs:logd for vldmgr:vldmgr 2022-01-04 11:27:25.457 -0800 Error: vldmgr_pkt_process(pkt.c:3638): Error handling read event on fd:16 for vldmgr:vldmgr 2022-01-04 11:27:25.457 -0800 Error: _process_fd_event(pan_vld_mgr.c:2282): Error processing the request from 16 on vld: vldmgr 2022-01-04 11:27:26.878 -0800 Connection to vld-0-0 established 2022-01-04 11:27:26.878 -0800 Connection to vld-1-0 established 2022-01-04 11:27:26.878 -0800 Connection to vld-2-0 established
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks