About ybommakanti

Hello Benjamin, Try the following command: debug log-receiver statistics This will show you how many logs were actually generated and written by the log receiver process.    Logging statistics ------------------------------ ----------- Log incoming rate:             0/sec Log written rate:              0/sec Corrupted packets:             0 Corrupted URL packets:         0 Logs discarded (queue full):   0 Traffic logs written:          76946 URL logs written:              195 Anti-virus logs written:       7 This will give you an indication if log receiver is even generating logs.Usually if traffic is allowed by default rule that is traffic between same zones is allowed and sessions are created but no logs will be generated.Also try looking at show session id from command line and there is a field called "session to be logged at end". This will also give you an idea.Once you see that logs are being generated then it might be an issue with web interface not showing the logs try accessing them from ACC tab.If you see that logs are not being generated then it could most likely hitting the default rule. Hope this helps. Yashwanth ... View more

Hello Sabyasachi, A login event to either cli or web interface will be written as a system log.You can configure the system logs to be forwarded as email using log setting under device. Hope this helps. Regards, Yashwanth ... View more

Hello ChuanhouLei, PaloAlto Networks firewall when configured for group mapping,will talk to active directory every 60 minutes by default This is configurable under group mapping settings,update interval. Once every 60 minutes (by default) an LDAP querry is sent to retrieve any changes or additions or deletions to user-group membership.Looks like you are seeing the issue where even when you removed the user from group from AD it is still not updating mapping on the Device and user can still access the website. Try changing the update interval to 60 seconds and check if that resolved the issue. Hope this helps. Yashwanth ... View more

Hello, This option is currently not available.There is no way to filter the logs using predefined address objects as the filters will query against the traffic log database which contains logs with ip addresses and not address objects .You can try filtering using a combination of source or destination IP-addresses to achieve this. Hope this helps. Yashwanth ... View more

Hello Suhaimi, Your observation is an expected behavior.As the name suggests log at session end option tags a session at it's very beginning and generates a log for it.Now the second log you see (facebook-base in your case) is created at session end. Hope this helps. Yashwanth ... View more

Hello, Anything originating from or to the PAN interface directly will not match PBF and will always use vr routing table.Since the IPSEC negotiation is done via the external interfaces it might have been the problem with your case where the request was going through the ISP mentioned in the routing table and the reply from the other ISP the below document explains it in detail: Hope this document helps you.it explains the problems you run into and how to resolve them.Tunnel traffic and traffic originating from the PAN interface directly do not lookup PBF rules and will always follow VR.This is by design.The document specifies how the configurations can be made to get around this problems by configuring two virtual routers. Kindly give it a try and get back to us if you have any more questions or if you run into any problems. Regards, Yashwanth Bommakanti ... View more