How to proactively monitor which firewalls stopped sending logs to panorama.

[SivakumarNarala]

Panorama is our log collector and all firewalls reporting to panorama forward the logs to panorama too.

However at times these logs stopped reaching panorama ( break due to several reasons ) and we end up finding them after a long time. This is causing anyone to loose important logs in Panorama.

So how can we proactively monitor this setup. So that if any firewall stops / breaks sending logs to panorama for a certain period of time, we get notified.

[PavelK]

Hello @SivakumarNarala

thank you for post.

I would separate this issue into 2 scenarios:

- Firewalls does not send logs to Panorama.

- Firewall is sending logs to Panorama, but logs are not available/searchable in GUI.

Personally, I came across both issues and with some regret I do not think I have a good solution, rather sharing some of the ideas.

For the first issue, I can think of two options:

- Use built-in log collector connectivity checker under: Panorama > Managed Devices > Troubleshooting >  Log Collector Connectivity, then select all Firewalls and press Execute. If the status is returned as a "Failure" for particular Firewall, then this is an indication of an issue. Depending on your organization, if you have dedicated NOC/SOC, you can let them to execute this regularly (For example once a week) to catch Firewalls not sending logs.

- If Firewall disconnects from log collector, there will be a system log event: ( eventid eq tls-session-disconnected ) with description ( description contains 'Device <Serial Number>-log-collection disconnected from the server' ). You can setup email alert under: Panorama > Log Settings > System > Add, then under Filter, you can build a filter based on for example event id or description to get an email alert. This can however get noisy.

For the scenario that logs are being sent to Panorama, but not displayed, it is harder to detect as this can be caused by a bug, reaching limit of active shards,... One way I can think of is to create a custom scheduled traffic report and add under: Selected Columns "Device Name" and set Time Frame to 24 Hours. If logs from certain Firewall are no longer available, the Firewall will be missing from report. This solution is far from ideal as someone still has to open report and spot missing Firewall.

Kind Regards

Pavel