Is it possible to migrate the missing logs to Panorama which are lost due to connectivity issues between Firewall and Panorama?

Is it possible to migrate the missing logs to Panorama which are lost due to connectivity issues between Firewall and Panorama?

3041
Created On 12/19/24 08:11 AM - Last Modified 03/24/25 20:49 PM


Question


  • The firewall and Panorama got disconnected for a while.
  • The connection has been restored.
  • Some logs of the logs during the disconnected period are missing in Panorama.
  • These logs are visible on the firewall's GUI.

Question: Is it possible to upload these logs to Panorama?



Environment


  • PAN-OS 10.1, 10.2, 11.1, 11.2
  • Log forwarding to Panorama
  • Next-Generation Firewall
  • Panorama


Answer


  1. Yes, the missing logs of Firewall on Panorama can be can be migrated to Panorama again
  2. The following command on the Firewall CLI will migrate the logs to Panorama.
request logdb migrate-to-panorama start end-time <value> start-time <value> type <value>

- end-time <value> : Datetime YYYY/MM/DD@hh:mm:ss (e.g. 2006/08/02@10:00:00)
- start-time <value> : Datetime YYYY/MM/DD@hh:mm:ss (e.g. 2006/08/01@10:00:00)
- type <value> : Log type (config, hipmatch, system, threat, traffic)
  1. Use the command below in firewall CLI for checking migration status.
> request logdb migrate-to-panorama status type <value>

- type <value> : Log type (config, hipmatch, system, threat, traffic)
  1. After some time, the Migrated logs are visible on the Panorama GUI.

[Executed Sample]

> request logdb migrate-to-panorama start end-time 2022/12/08@00:00:00 start-time 2022/12/07@00:00:00 type threat
Migration to LC started for type: threat
Check command 'request logdb migrate-to-panorama status' to check the status.

> request logdb migrate-to-panorama status type threat

Last log succesfully migrated timestamp: 2022/12/30 09:39:34
Migrating logs from (going backwards): 2022/12/08 00:00:00
Migrating logs until : 2022/12/07 00:00:00
Number of logs migrated: 10
Status: Migration going on
percent_complete: 10 

 



Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000TpQpCAK&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language