All Apps and Add-ons

Palo Alto Networks Add On (6.3.1) not parsing globalprotect logs after 9.1.4 upgrade

Engager

We swapped firewalls running version 8.1.15 and GP 4.1.12 to a replacement running version 9.1.4 and GP 4.1.12.   Prior to the upgrade Add on 6.3.0 was gathering data and appropriately displaying dashboard data.   After upgrading Add on and App to 6.3.1 I'm still getting nothing in my Global Protect Dashboard.   I'm not seeing data in the dashboard after the upgrade to 9.1.4.    I can see the data prior to the upgrade.   I've checked the forwarding configuration and that is fine: BSD Format and no timestamps appended.    Not sure what I'm missing.    Data models are at 100% and other than globalprotect seem to be ok.

Labels (3)
0 Karma
1 Solution

Engager

This appears to be due to changes in the logging of global protect within the PAN-OS release itself.    It appears to require explicit forwarding that was happening implicitly previously.   

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/globalprotect-features/enhanced-log...

View solution in original post

0 Karma

Engager

This appears to be due to changes in the logging of global protect within the PAN-OS release itself.    It appears to require explicit forwarding that was happening implicitly previously.   

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/globalprotect-features/enhanced-log...

View solution in original post

0 Karma