PAN-OS 9.1.1 Breaks Data Model?

[gfisbeck]

My network team upgraded our Palo Altos to 9.1.1 and it looks like Palo Alto may have changed the format of GlobalProtect logs... I'm no longer seeing activity in the data model matching the following search:

| tstats summariesonly=t latest(log.event_id) AS latest_event, values(log.agent_message) AS log.agent_message, values(log.src_ip) AS log.src_ip count FROM datamodel="pan_firewall" WHERE nodename="log.system.globalprotect" groupby _time log.event_id log.user
| rename log.* as * 
| search event_id="globalprotectportal-auth-succ" 

Essentially, all events matching the WHERE clause: nodename="log.system.globalprotect" stopped after the upgrade.

Has anyone else seen this issue? Does anyone know if there's a fix for this in the works?

[panguy]

Yes, I can confirm this is a breaking update for GlobalProtect.

GlobalProtect now has its own log type. It is no longer apart of the system log type. We will be updating the app and add-on to reflect this change.

Since GlobalProtect has it's own log type, you need to activate log forwarding for GlobalProtect. This can be done at Device -> Log Settings. You will see a new section for GlobalProtect as well as IP-TAG logs. Add a filter to the section to forward logs.

[dking8921]

Thanks for confirming. I'd also love a few tips for possibly working around this. Thanks!

[AMCollins]

panguy,

Any ETA on the update for the app and add-on? If it isn't soon, can you provide some good instructions for a work around?

Thanks!