>
    Strata Copilot
    Prisma Agent Log Event Details
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Agent
    3. Troubleshoot Prisma Agents
    4. Audit Prisma Agent Logs and Management Logs
    5. Audit Prisma Agent Logs
    6. Prisma Agent Log Event Details
    Download PDF
    Prisma Agent

    Prisma Agent Log Event Details

    Table of Contents

    Prisma Agent Log Event Details

    Review detailed descriptions of Prisma Agent events to help understand Prisma Agent logs.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Panorama)
    • NGFW (Managed by Panorama)
    • Check the prerequisites for the deployment you're using
    • Contact your Palo Alto Networks account representative to activate the Prisma Agent feature
    To help you understand an event that has occurred, you can review descriptions of log events that are related to the Prisma Agent.
    The event IDs in the following table correspond to the values in the Event ID Value (event_id.value) field in the log viewer. You can create log queries based on the values the event_id.value field.
    The following event IDs are used in the agent log subtype.
    Event IDDescription
    gateway-authIndicates the gateway authentication stage. See Event Status for results.
    gateway-config-releaseIndicates a gateway event for configuration release, such as remove ip-user mapping or remove tunnel.
    gateway-connectedIndicates a gateway event for a Prisma Agent successful connection for tunnel mode.
    gateway-getconfigIndicates a gateway event for generating Prisma Agent configuration, such as split-tunnel, virtual IP, or tunnel information.
    gateway-hip-checkIndicates a gateway event to confirm whether a Prisma Agent HIP report was updated or not, and to refresh ip-user mapping.
    gateway-hip-reportIndicates a gateway event to confirm whether a HIP report was received from a Prisma Agent, to update ip-user mapping, and to enforce HIP policy.
    gateway-logoutIndicates a gateway event for a Prisma Agent logout.
    gateway-preloginIndicates a gateway event. As a part of the event, the Prisma Agent does the following:
    • Certificate: Validates whether a client certificate is valid.
    • SAML: Generates a SAML request and sends it back to a Prisma Agent.
    gateway-registerIndicates Prisma Agent user information, such as username, domain-name, computer name, hostid, serial number, public ip, or login time is added on the gateway.
    gateway-setup-ipsecIndicates a gateway event for setting up the IPSec tunnel.
    gateway-switch-to-sslIndicates a gateway tunnel switch from IPSec to SSL when the IPSec tunnel was not successful.

    © 2026 Palo Alto Networks, Inc. All rights reserved.