All the logs are not seen on PA-3400 Series firewall

All the logs are not seen on PA-3400 Series firewall

12979

Created On 01/23/23 13:47 PM - Last Modified 01/20/25 09:01 AM

Logs

Reporting and Logging

10.2

11.0

Next-Generation Firewall

Symptom

URL and Decryption logs are not generated.
When checking the maximum logging rate, it is set for 1280 cnt/s:

> show system setting logging

Max. logging rate:            1280       cnt/s         <<<<<
Max. packet logging rate:     2560       KB/s
Traffic log generation rate:  2466       cnt/s  591840    Byte/s

In the "show counter global" command, Log_traffic_loss_queue_full or log_threat_queue_full counters are incrementing.

Environment

PA-3400 Series firewalls.
PAN-OS 10.2.x and 11.0.0.

Cause

The Max. logging rate is set to 1280 logs/s for PA-3400 series firewalls.
The firewall starts dropping logs when the logging rate exceeds 1280 logs/s.

Resolution

This issue is fixed via PAN-206253 in PAN-OS 10.2.4 and 11.0.1
The fix increases the default Max. logging rate from 1280 to 20000 logs/s.
Upgrade of the PAN-OS should resolve the issue.

Additional Information

As a workaround, we can increase the Max. logging rate to 6826 using:

> set system setting logging max-log-rate 6826

However, if the logging rate exceeds 6826 logs/s, the system will start dropping logs.