How to find relevant logs for Prisma SD-WAN issues

How to find relevant logs for Prisma SD-WAN issues

6564
Created On 07/15/24 14:00 PM - Last Modified 01/17/25 07:08 AM


Objective


To review log files based on the incident's product area



Environment


  • Prisma SD-WAN 
  • ION devices
  • Strata Cloud Manager


Procedure


Related log files for Product/Feature Areas

Product Area

Related log files (facility)

Prisma SD-WAN VPN/SecureFabric

VPN, daemon, elem-mgr, event, UI Alerts/Incidents

HA

HAM, elem-mgr, event, UI HA status, UI Alerts/Incidents

FC

flow-ctrl, daemon, local0, user, fib-mgr, UI Alerts/Incidents

ServiceLink

local1, tunnel-mgr, elem-mgr, probe, UI Alerts/Incidents

Interface and hardware issues

elem-mgr, daemon, emif, user, UI Alerts/Incidents

controller

Mrl_agent, mrl_access, elapi, cgnx-infra, elem-scm, micmac, local5

LQM

wpa,

Cellular 

cman

Routing

rtr-mgr, daemon, fibmgr

Element sync issue 

elapi

ADEM

adem

DNS service

nsm

DHCP/DHCP Relay

daemon

IPFIX serve

ipfix

DeviceID/IoT service

Log-agent, device_cer

SNMP

daemon

Multicast

mcastsvc, daemon, rtr-mgr

Apps/app-engine

ngpcap, app-probe, daemon

Switching

mstp, emif, 

Wan reachability

wpa

FIPS

cgssl

Path/Security/QoS policy

flow-ctrl

Memory leak

user, local0


Logs can be checked in different ways, for example:

  1. Filter logs within a time frame
debug logs dump [start=<datetime>] [end=<datetime>] [raw] [facility...]
Example:
debug logs dump start=2024-06-08T19:00:00 end=2024-06-09T19:00:00  elem-mgr flow-ctrl
  1. Dump logs live as they are generated (similar to 'tail -f file.log' in Linux)
    debug logs follow flow-ctrl
  2. Dump all logs at once
debug logs dump





Additional Information


Official CLI reference guide.



Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000010zFMCAY&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language