Unable to import a CSV log file back into the Firewall
219
Created On 08/26/22 20:03 PM - Last Modified 11/11/25 23:27 PM
Symptom
When trying to import back a CSV log file into a Palo Alto Networks Firewall it fails.
- The CSV File can have Traffic, Threat, URL Filtering, Wildfire logs, etc.
- Below is a failure after trying to import back from a Windows Host machine a CSV file that was previously exported named 'BCMSPANF02_traffic_2022_03_15_00_00_00_to_2022_04_01_08_00_00_0'
admin@Lab142-60-PA-3250> scp import logdb from css125991@10.101.178.137:C:\fw-logs\BCMSPANF02_traffic_2022_03_15_00_00_00_to_2022_04_01_08_00_00_0 Entering log import mode ssh: connect to host 10.101.178.137 port 22: Connection timed out gzip: stdin: unexpected end of file /bin/tar: Child returned status 1 /bin/tar: Error is not recoverable: exiting now lines 1--1...skipping... Exited log import mode
Environment
- Any Palo Alto Networks Firewall
- Any PANOS version
Cause
This functionality is currently unsupported. The only log instance that can be imported into the Palo Alto Networks Firewall is the Logdb database. The Logdb database uses proprietary compression algorithms and it cannot be decompressed and viewed.
Resolution
If you require to export and then import back a CSV file that holds the logs, the recommendation is to export the Complete Log Database (Logdb) and then import it back with the steps below:
- Step 1: Export a log database to an SCP-enabled server using the scp export command in operational mode. When prompted, enter the password for your SCP server account. For example:
admin@fw1> scp export logdb to <username@host:path_to_destination_filename> For an SCP server running on Windows, the destination folder/filename path for both the export and import commands requires a drive letter followed by a colon. For example: admin@fw1> scp export logdb to ccrisp@10.10.10.5:c:/fw-logs/fw1-logdb
- Step 2: Log in to the firewall on which to import a log database, and then enter the import command. When prompted, enter the password for your SCP server account.
admin@fw2> scp import logdb from <username@host:path_to_destination_filename> On a Windows-based SCP server admin@fw2> scp import logdb from ccrisp@10.10.10.5:c:/fw-logs/fw1-logdb