How to verify the information of Included/Excluded domains and Applications in the PANGPS log?

• Palo Alto Firewall.
• Supported PAN-OS
• GlobalProtect (Gateway and App)
• Split Tunnel Based on the Domain and Application.

1. Upon a successful Gateway Login,  GP Client sends "Get gateway config" getconfig.esp,POST REQUEST to the Gateway.
2. The client receives the GATEWAY configuration.
3. In Pangps logs , Excluded Domains from GP tunnel, "*.netflix.com,*.zoom.us, *.zoom.com, *.ringcentral.com, *.primevideo.com"  are seen as Excluded from the tunnel:

<exclude-split-tunneling-domain>
   <member>*.netflix.com</member>
   <member>*.zoom.us</member>
   <member>*.zoom.com</member>
   <member>*.ringcentral.com</member>
   <member>*.primevideo.com</member>
</exclude-split-tunneling-domain> 

5. Similarly the Included Domains through the GP tunnel, are seen under "include-split-tunneling-domain" as shown.

 <include-split-tunneling-domain>
        <member>*.xyz.local</member>
  </include-split-tunneling-domain> 

6.  Excluded applications from the tunnel are seen under <exclude-split-tunneling-application>,  Zoom application is Excluded in the below example:​​​​​

<exclude-split-tunneling-application>
       <member>%AppData%\Roaming\Zoom\bin\Zoom.exe</member>
       <member>/Applications/zoom.us.app/Contents/MacOS/zoom.us</member>
       <member>C:\Program Files (x86)\Zoom\bin\Zoom.exe</member>
</exclude-split-tunneling-application> 

7. The Log also provides  the number of Included/Excluded Doamins and Applications:

"(P5864-T6980)Debug( 772): 08/02/22 20:03:01:719 Split tunneling is enabled: 0 include app, 3 exclude app, 1 include domain, 5 exclude domain, video-redirect yes"

• How to collect GlobalProtect Logs 
• Where is GlobalProtect Log Located