How to Collect Logs from GlobalProtect 6.0 Clients

How to Collect Logs from GlobalProtect 6.0 Clients

Created On 06/15/23 17:35 PM - Last Modified 06/17/23 01:17 AM


This document describes how to generate and collect logs for troubleshooting GlobalProtect VPN


  • GlobalProtect App Version 6.0
  • Windows, macOS, Linux, and mobile endpoints 


For Windows Clients
For Mac Clients
For Linux Clients
For Mobile Devices (Android & iOS)
  • There are 2 different ways that you can get log files from GlobalProtect inside the "Troubleshoot" tab. 
  • The first way to see the logs is to Start and Stop the logs to view them live. This can be helpful to start and stop the logs to capture a certain Connection issue or another event.

For Windows Clients
  1. Start by right-clicking the GlobalProtect icon on the taskbar
  1. Then click the triple-bar icon and click Settings
click triple bar icon and click Settings screenshot
  1. On the GlobalProtect Agent window, go to the Troubleshooting tab, click Advanced, and select Logs.
How to turn on live log printing for GlobalProtect application
  1. Set Log type to PanGP Service. The PanGP Service (Windows Service) logs every connection attempt and all errors encountered during that time.
  2. Set Debug Level to Debug
  3. Before a certain event happens, click Start to start the logs. After the event, click Stop to stop the logs.
click Stop on GlobalProtect log collection
  1. After you have logs on the screen, you can take a screenshot, or just scroll through the event as it is happening. This can help show exactly what is going on when the issue occurs. 
  1. The second way to collect logs is from the same Troubleshooting window, click the Collect Logs button.
click Collect Logs
  1. This will bring up the Save Logs window. Click the Open Folder button
click Open in Folder to view the
  1. This brings up a Windows Explorer window. Look for the file.  This is what you can unzip yourself or send off to Support so they can help troubleshoot what is going on. file example screenshot in Windows Explorer 
For Mac Clients
1. Click on the GlobalProtect client icon on the top of the home screen. Click on the triple-bar icon and select Settings.
Mac steps - click GlobalProtect tray icon - click Gear Icon - click Settings
 2.  A new window will pop up. Go to the Troubleshooting tab and click the Collect Logs button.

Mac - click Collect Logs


3. The collected logs will be saved.  Click Open Folder to navigate to the file
Mac - click Open Folder
To collect GP logs from MacOS Terminal
sh /Applications/ <save location>

user1@Labhost% sh /Applications/ /Users/user1

Executing: /usr/bin/kmutil showloaded
No variant specified, falling back to release
/Applications/ /Applications/
a DNS.txt
a DemPathTestService-2023-06-16-111008.ips
a IfConfig.txt
a MachineState.txt
a NetStat.txt
a PanGPA.log
a PanGPA.log.old
a PanGPS.log
a PanGPS.log.old
a PanGpHip.log
a PanGpHipMp.log
a PanNExt.log
a PanNExt.log.old
a Proxy.txt
a RoutePrint.txt
a SystemInfo.txt
a Top.txt
a com.paloaltonetworks.DemUpdateService 2023-06-05--02-08-33-832.log
a com.paloaltonetworks.GlobalProtect.settings.plist
a debug_drv.log
a debug_drv_old.log
a pan_gp_event.log
a pan_gp_hrpt.xml
a pan_gp_trb.log
a sysext.service.log
a system.log
a system.log.0.gz
a system.log.1.gz
a system.log.2.gz
a system.log.3.gz
a system.log.4.gz
a system.log.5.gz
a system.log.6.gz
a systemextensionsctl.txt
The support file is saved to /Users/user1/GlobalProtectLogs.tgz
For Linux Machines 
  1. The PANGPI and PANGPA logs are stored in the below location on the Linux Machine.



  1. To collect the Client logs use the below commands on the terminal. 
user1@Labhost:~$ globalprotect

Start collecting...
collecting network info...
collecting machine info...
copying files... 
generating final result file...
The support file is saved to /home/user/.GlobalProtect/Collect.tgz
  1. Export the Collect.tgz file from the above given location.


For mobile devices (Android and iOS)
  1.  In GlobalProtect agents for mobile devices, select Help > Troubleshoot and then choose to email the logs to a recipient. This operation requires an Email Account.

Additional Information

For additional information, please refer to the following documents:

  • Print
  • Copy Link

Choose Language