Elasticsearch is not Running after PAN-OS Upgrade due to Missing __pan_cluster__.log

Elasticsearch is not Running after PAN-OS Upgrade due to Missing __pan_cluster__.log

1225
Created On 07/23/25 07:14 AM - Last Modified 10/02/25 21:13 PM


Symptom


  • After PAN-OS upgrade on Log Collector, ES status underĀ Panorama > Managed Collectors > Health Status shows red circle and "not running".
  • On Log Collector, there is no elasticsearch process under 'show system software status'.
  • Executing less es-log ? shows there is no log file exists for elasticsearch..
  • Log Collector's esmonitor.log shows there are error messages indicating __pan_cluster__.log is missing and elasticsearch is not running (failed to connect to localhost port 9200: Connection refused),
    23:47:47.478 +0000 syscmd: executing: curl -sS --max-time 10 --connect-timeout 5 "localhost:9200/_cluster/health?pretty&local"
    curl: (7) Failed to connect to localhost port 9200: Connection refused
    23:47:47.494 +0000 Error: esmonitor_check_elasticsearch_status(pan_es_status.c:256): ELASTICSEARCH STATUS: Failed to parse JSON response.
    Traceback (most recent call last):
    File "/usr/local/bin/es_restart.py", line 1471, in
    check_state_file()
    File "/usr/local/bin/es_restart.py", line 1264, in check_state_file
    with open(ES_CLUSTER_FILE) as es_f:
    FileNotFoundError: [Errno 2] No such file or directory: '/var/log/elasticsearch/__pan_cluster__.log'
    23:47:48.332 +0000 Error: timer_callback(pan_es_timer.c:91): TIMER: Failed to execute es_restart.py to check for empty state files.


Environment


  • Panorama managed log collector
  • Single log collector in a cluster


Cause


__pan_cluster__.log which required by elasticsearch is missing.



Resolution


  1. Full push from Panorama to the log collector.
  2. Once the full push is successful, the log file will be created.
  3. Recheck the health status it should show green as the service is now started.


Additional Information




Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000kA3gKAE&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail