Unable to see logs on Panorama | vld-x-x.log: corrupted compressed block contents
3232
Created On 10/11/23 10:22 AM - Last Modified 10/08/24 23:57 PM
Symptom
- Logs not visible on Panorama
- debug log-collector log-collection-stats show incoming-logs shows 0 Incoming log rate
- Logs are not getting ingested as per vld-0-0.log [ES_INGEST ERR]:
2023-09-12 01:30:14.485 -0700 Error: _index_get(pan_index_leveldb_wrapper.cpp:1191): Error getting key from idx db. Error: Corruption: corrupted compressed block contents
2023-09-12 01:30:14.485 -0700 Error: pan_leveldb_index_get(pan_index_leveldb_wrapper.cpp:1229): Error getting key from idx db
2023-09-12 01:30:14.485 -0700 Error: _segdb_get(vld_quota.c:117): Error getting value for db_info_idx:0, timeb:1694505600 for segnum:158 for vld:vld-0-0
2023-09-12 01:30:14.485 -0700 Error: _segdb_val_get(vld_quota.c:142): Error getting value for db_info_idx:0, timeb:1694505600 for segnum:158 for vld:vld-0-0
2023-09-12 01:30:14.485 -0700 Error: _update_segdb(vld_quota.c:1045): Error getting the segdb val for timeb:1694505600 segnum:158 for vld:vld-0-0
2023-09-12 01:30:14.485 -0700 Error: vld_quota_handle_stat_notify(vld_quota.c:5026): Error while updating the quota of timeb:1694505600 in segnum:158 type:traffic for vld:vld-0-0
2023-09-12 01:30:16.339 -0700 ESRA app(0x55fd82911b00) fd(552, 1, 0) WRITING bytes(8713515), rec(4762) type(0) indexname(pan_20230912_68_traffic_000710000817-0)
2023-09-12 01:30:17.266 -0700 ESRA app(0x55fd82911b00) fd(552, 8, 826033) Sent bytes (8713515) successfully
2023-09-12 01:30:19.337 -0700 Error: http_put_clnt(es_rest_api.c:785): ESRA app(0x55fd2fcced00) fd(553, 4, 0) resp(6307857, 4904, 1) ES_INGEST ERR (reason = "failed to parse field [characteristic-of-app] of type [integer] in document with id 'AYqIgzNk1JFc37GbEITc'")
Environment
- PAN-OS-10.1.10-hx
- Panorama
Cause
- Due to metadata corruption, logs are not purged properly causing issues with ingestion.
Resolution
Regenerate metadata
Will there be any log loss when regenerating metadata on Panorama