Is it possible to migrate the missing logs to Panorama which are lost due to connectivity issues between Firewall and Panorama?
3041
Created On 12/19/24 08:11 AM - Last Modified 03/24/25 20:49 PM
Question
- The firewall and Panorama got disconnected for a while.
- The connection has been restored.
- Some logs of the logs during the disconnected period are missing in Panorama.
- These logs are visible on the firewall's GUI.
Question: Is it possible to upload these logs to Panorama?
Environment
- PAN-OS 10.1, 10.2, 11.1, 11.2
- Log forwarding to Panorama
- Next-Generation Firewall
- Panorama
Answer
- Yes, the missing logs of Firewall on Panorama can be can be migrated to Panorama again
- The following command on the Firewall CLI will migrate the logs to Panorama.
request logdb migrate-to-panorama start end-time <value> start-time <value> type <value>
- end-time <value> : Datetime YYYY/MM/DD@hh:mm:ss (e.g. 2006/08/02@10:00:00)
- start-time <value> : Datetime YYYY/MM/DD@hh:mm:ss (e.g. 2006/08/01@10:00:00)
- type <value> : Log type (config, hipmatch, system, threat, traffic)
- Use the command below in firewall CLI for checking migration status.
> request logdb migrate-to-panorama status type <value>
- type <value> : Log type (config, hipmatch, system, threat, traffic)
- After some time, the Migrated logs are visible on the Panorama GUI.
[Executed Sample]
> request logdb migrate-to-panorama start end-time 2022/12/08@00:00:00 start-time 2022/12/07@00:00:00 type threat
Migration to LC started for type: threat
Check command 'request logdb migrate-to-panorama status' to check the status.
> request logdb migrate-to-panorama status type threat
Last log succesfully migrated timestamp: 2022/12/30 09:39:34
Migrating logs from (going backwards): 2022/12/08 00:00:00
Migrating logs until : 2022/12/07 00:00:00
Number of logs migrated: 10
Status: Migration going on
percent_complete: 10