Elasticsearch is not Running after PAN-OS Upgrade due to Missing __pan_cluster__.log
1225
Created On 07/23/25 07:14 AM - Last Modified 10/02/25 21:13 PM
Symptom
- After PAN-OS upgrade on Log Collector, ES status underĀ Panorama > Managed Collectors > Health Status shows red circle and "not running".
- On Log Collector, there is no elasticsearch process under 'show system software status'.
- Executing less es-log ? shows there is no log file exists for elasticsearch..
- Log Collector's esmonitor.log shows there are error messages indicating __pan_cluster__.log is missing and elasticsearch is not running (failed to connect to localhost port 9200: Connection refused),
23:47:47.478 +0000 syscmd: executing: curl -sS --max-time 10 --connect-timeout 5 "localhost:9200/_cluster/health?pretty&local"
curl: (7) Failed to connect to localhost port 9200: Connection refused
23:47:47.494 +0000 Error: esmonitor_check_elasticsearch_status(pan_es_status.c:256): ELASTICSEARCH STATUS: Failed to parse JSON response.
Traceback (most recent call last):
File "/usr/local/bin/es_restart.py", line 1471, in
check_state_file()
File "/usr/local/bin/es_restart.py", line 1264, in check_state_file
with open(ES_CLUSTER_FILE) as es_f:
FileNotFoundError: [Errno 2] No such file or directory: '/var/log/elasticsearch/__pan_cluster__.log'
23:47:48.332 +0000 Error: timer_callback(pan_es_timer.c:91): TIMER: Failed to execute es_restart.py to check for empty state files.
Environment
- Panorama managed log collector
- Single log collector in a cluster
Cause
__pan_cluster__.log which required by elasticsearch is missing.
Resolution
- Full push from Panorama to the log collector.
- Once the full push is successful, the log file will be created.
- Recheck the health status it should show green as the service is now started.