Device <serial_number>-log-collection-lr-cms0-def disconnected from the server

Device <serial_number>-log-collection-lr-cms0-def disconnected from the server

544
Created On 08/12/25 08:26 AM - Last Modified 01/21/26 22:30 PM


Symptom


  • Firewalls  configured to send logs to panorama.
  • System logs report log forwarding connection between firewall to panorama is constantly disconnecting/connecting with the following messages.
    • EVENT " tls-session-disconnected"
    • DESCRIPTION "Device ****-log-collection-lr-csm0-def disconnected from the server"

 

Environment


  • Panorama managed Firewalls
  • PAN-OS: 10.2.x

Cause


Log Forwarding Preferences (Preference List) is not configured.

Resolution


  1. For log forwarding from firewall to panorama, ensure that preference list configuration is present and pushed to the collector group.
  2. Panorama > Collector Groups > CG_Name > Device Log Forwarding > Log Forwarding Preferences
  3. Commit > Push to Devices > Collector Groups > CG_Name and click "OK"

 

Additional Information


N/A
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000bll3KAA&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail