Exported correlation logs resulted in empty CSV file

3155

Created On 12/06/22 00:51 AM - Last Modified 10/08/24 23:45 PM

Correlation Log

Reporting and Logging

Next-Generation Firewall

Symptom

Monitor > Correlation logs result in the empty csv file when exported - log2.csv adding the image :

When checking from the CLI and GUI we could see the logs:

admin@PA-3220-A> show log corr

Domain,Receive Time,Serial #,Type,Threat/Content Type,Config Version,Generate Time,Source address,Source User,Virt ual System,Category,Severity,DG Hierarchy Level 1,DG Hierarc
hy Level 2,DG Hierarchy Level 3,DG Hierarchy Level 4,V irtual System Name,Device Name,Virtual System ID,Object Name,Object ID,Evidence,match_oid
1,2019/01/24 08:55:54,xxxxxxxxx,CORRELATION,,,2019/01/24 08:55:54,10.10.206.103,,vsys1,compromised-host,medium, 0,0,0,0,vsys1,,0,xxxxxxxxxxxx,6005,Host visited known m
alware URL (64 times).,xxxxxxxxxx

Environment

PAN-OS 10.1.3
PA-3220

Cause

Max Rows 1048576 in CSV Export is causing the issue

Resolution

Fixed in PAN-OS 10.2.4 and 10.1.10

Workaround:

Device > Setup > Management > Logging and Reporting Settings > Max Rows in CSV Export > set as 65535 or less than 1048576

Commit the configuration

Additional Information