How to retrieve old log files of the previous PAN-OS version after an upgrade/downgrade?

• PAN-OS upgrade has been performed without generating tech support file.
• Crucial old log files from the previous system are required for analysis.
• These files are not in the tech support file after upgrade.
• This article provides steps to revert the PAN-OS version and collect the old log files.

• Palo Alto Firewalls
• Supported PAN-OS
• Filesystem root partitions sysroot0 and sysroot1

1. Revert the PAN-OS to the old PAN-OS Refer:  "How to revert to the last PAN-OS installed software installed using CLI"
2. Upon device restart, navigate to the web GUI (Device > Support > Tech Support File), proceed to Generate Tech Support File, and then Download Tech Support File. This downloaded file will encompass the old log files from the expected PAN-OS version.
3. Execute the CLI command debug swm revert once again and reboot the device to return to the initial PAN-OS version.

Note: If rebooting the device is not feasible (e.g., due to network restrictions or prior PAN-OS version issues), open a tech support case to request assistance. TAC engineers can then directly retrieve old log files from the REVERTABLE partition, as root access is required and exclusive to TAC engineers.