Exporting CSV Traffic Logs Fails to Download Completely on PA-2000 Series Firewall

Issue

The CSV export of traffic logs from the web UI on a PA-2000 Series firewall fails to download completely when the Max Rows in CSV Export value is set to the maximum (1048576). The traffic log files will typically be greater than 300MB, but the downloaded file only contains a fraction of the total data.

Note: This behavior is only apparent on PA-2000 Series firewalls.

The Max Rows in CSV Export value is configured at: Device > Setup > Management > Logging and Reporting Settings.

Regardless of the web browser, the download will still timeout. IE displays the error, "log.csv download was interrupted". On Firefox, there is no error but the download bar will close as if no issue has occurred.

There is no exact threshold for "Max Rows in CSV Export" in which the issue will occur. The defining factors are the size of the CSV file and the bandwidth of the connection to retrieve it. Making the "Max Rows in CSV Export" value to the max entry of 1048576 will produce a CSV file greater than 300MB, thereby taking a longer time to download. If the download takes more than 6 minutes, the downloaded CSV file will only be a portion of the overall CSV file. If the client downloading the file is from a remote site with a slow connection, the downloaded file will be smaller because of the 6-minute timeout.

Cause

The download is timing out because the WEBUI service timeout on the Palo Alto Networks firewall is 6 minutes. The timeout value prevents the WEBUI service from keeping resources tied up by a particular connection and is not configurable either via WEBUI or CLI.

Resolution

The workaround is to use the Scheduled Log Export via SCP or FTP. Or, the value (default is 65535) of "Max Rows in CSV Export" can be decreased to ower the size of the file and increase the probability that the download will complete within 6 minutes.

owner: jlunario