Palo Alto Networks Add On (6.3.1) not parsing globalprotect logs after 9.1.4 upgrade

[bseppanen1]

We swapped firewalls running version 8.1.15 and GP 4.1.12 to a replacement running version 9.1.4 and GP 4.1.12.   Prior to the upgrade Add on 6.3.0 was gathering data and appropriately displaying dashboard data.   After upgrading Add on and App to 6.3.1 I'm still getting nothing in my Global Protect Dashboard.   I'm not seeing data in the dashboard after the upgrade to 9.1.4.    I can see the data prior to the upgrade.   I've checked the forwarding configuration and that is fine: BSD Format and no timestamps appended.    Not sure what I'm missing.    Data models are at 100% and other than globalprotect seem to be ok.

[bseppanen1 · Accepted solution]

This appears to be due to changes in the logging of global protect within the PAN-OS release itself.    It appears to require explicit forwarding that was happening implicitly previously.   

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/globalprotect-features/enhanced-log...