Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

323086
Created On 09/25/18 17:27 PM - Last Modified 05/20/20 21:29 PM


Symptom


Panorama, deployed as either the Palo Alto Networks M-100 device or as a virtual appliance, stops receiving logs from Palo Alto Networks firewalls. The traffic and threat logs can be viewed when looking directly on the firewalls, but are not visible on Panorama.

Environment


  • Any Panorama
  • PAN-OS 6.1, 7.0, 7.1, 8.0, 8.1 and 9.0


Cause


The Palo Alto Networks firewall keeps track of the logs forwarded to Panorama with a sequence number. When the logs are received, Panorama acknowledges the sequence number. If the firewall is connected to a different Panorama (for example, to an HA peer of a Panorama), these sequence numbers can become out of sync causing the firewall not to forward any logs. The log upload process can also become stuck by a large volume of logs being sent to Panorama.

Resolution


 

  1. Check current logging status
> show logging-status device <serial number>
  1. Start log forwarding with buffering, starting from last ack'ed log ID
> request log-fwd-ctrl device <serial number> action start-from-lastack
  1. Verify if logs are being forwarded
> show logging-status device <serial number>
If logs are not being forwarded, do the following:
  1. Make sure that log forwarding is stopped
> request log-fwd-ctrl device <serial number> action stop
  1. Start log forwarding with no buffering  (leave in this state for about a minute)
> request log-fwd-ctrl device <serial number> action live
  1. Start log forwarding with buffering
> request log-fwd-ctrl device <serial number> action start
 

 



Additional Information


Important Notes:
The alphabet characters in the serial number must be all upper case. For example:

> request log-fwd-ctrl device 0000C123456 action live

scheduled a job with jobid 12

 

If lower case characters are used, then the following error message is returned:

> request log-fwd-ctrl device 0011c123456 action live

Server error : failed to schedule a job to do log fwd ctrl from panorama to device 0000c123456

 

Confirm that the device policies are set with log action forward to Panorama.

If the logging gets stuck, restart the log-receiver service with the following command:

> debug software restart log-receiver
 

Alternatively, restart the management server (which also restarts the log-receiver service) with the following command:

> debug software restart management-server
 

On PAN-OS 7.0, 7.1 and 8.0, 8.1 and above , please use the following command to restart the management server process:

> debug software restart process management-server


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFCCA0&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language