Table of Contents
Expand all | Collapse all
-
- Access.Log
- Advanced L7 Services Shared Memory State
- Advanced Routing BFD Details
- Advanced Routing Resources and Routes
- AIOps Application Logs
- AIOps Node Details
- AIOps Node Endpoints
- AIOps Node Topology
- AIOps VLD Manager Logs
- App Command Center Reports
- App Command Center Reports
- ARP Management Table
- ARP Table
- Audit.Log
- Authentication Daemon (authd) Log
- BFD Session Details
- Cellular Modem Data Session Information
- Chassis Inventory
- Chassis Power Status
- Chassis Ready State
- Chassis Status
- CIE CLI commands
- Cloud Management Connection Status
- Cluster Node Consistency Check
- Content Update Counters
- CPU Load Sampling by Firewall Function
- CPU Utilization Statistics
- Crash and Trace Files
- CTD Configuration State
- Data-Management Plane Health Heartbeat
- Dataplane Packet Diagnostics Settings
- Device Certificate Status
- Device Certificate Status
- Device Logging Health
- Device Logging Preference List
- Device Server FQDN Resolved IPs
- Device Telemetry Curl Logs
- Device Telemetry Send.Log
- Disk Usage and Dangling File Descriptors
- Distributord.Log
- DOS Block Table
- DPDK Packet I/O Settings
- Dscd.Log
- Configuration lock log
- Configuration lock log
- EDL Capacities
- Elasticsearch Aliases
- Elasticsearch Certificates
- Elasticsearch Cluster Pending Tasks
- Elasticsearch Cluster Tasks
- ElasticSearch health
- Elasticsearch Indices
- Elasticsearch Invalid Replicas
- Elasticsearch Nodes
- Elasticsearch Shard Information
- Elasticsearch Unassigned Shards
- Error.Log
- Filemgr connection status
- Firewall pcap enablement status
- Front LED State
- GlobalProtect Client Versions
- GlobalProtect Gateway Statistics
- GlobalProtect hip-profile-database statistics
- GlobalProtect Logs
- GlobalProtect Logs (Extended)
- GlobalProtect Operating System Types
- GlobalProtect Portal Connection Failure
- GlobalProtect Quarantined Devices
- Globalprotect Service Logs
- GlobalProtect Successful Connections
- Gp Broker.Log
- GP Portal Satellite Authentication Status
- HA and Configuration SDB Variables
- HA Health Errors
- HA System State
- Hardware Alarms
- Hardware and Software Pools
- Hardware Ports
- Hardware System Logs
- Hardware System Logs
- High Availability
- High Availability Backup Interfaces
- High Availability Interface 1
- High Availability Interface 2
- High Availability Interface 4 Backup
- Icd.Log
- Indexgen.Log
- Ingress Backlogs
- Install-History
- Installed Plugins and Jobs
- Inter Log Collection Block Statistics
- Inter Log Collector Status
- IoT Troubleshooting Data
- IoT Verdict Statistics
- Iotd.Log
- IP-User Mapping Count
- IPSec Tunnel Flow Details
- IPSec VPN Tunnel Flow Details
- IPSec-VPN Tunnel Flow
- IPv6 Neighbor Table
- L2Ctrld.Log
- L3Svc Ngx Error.Log
- LACP Aggregate Ethernet Statistics
- Last Commit Information
- Lcaas Agent.Log
- Log Collector Hints
- Log Daemon Queue Statistics
- Log Forwarding Generation Rate
- Log Forwarding Statistics
- Log Receiver Hints Statistics
- Log Receiver Queue Statistics
- Log Receiver Raw Log Forwarding Connection Manager
- Log Receiver Statistics
- LogDB Quotas
- Logging Rate
- Logging Statistics
- Logging Status
- MAC Address Table
- Managed Devices
- Management Interface
- Management Server Client Connections
- Management Server Connections
- Management to Data Plane Counters
- Md Out.Log
- Merged-Running-Config.Xml
- MLAV cloud connection status
- Mp-Monitor.Log
- Ms.Log
- NAT Pool Utilization
- netstat
- Nsx Frr Export.Log
- Number of entries in the PBF Return-mac
- Octeon Chip Health
- Operational Command History
- Packet Buffer Protection
- Packet Scheduling Engine Performance
- Packet Scheduling Engine Status
- Pan Cluster Logs
- Pan Dhcpd.Log
- PAN-DDNS Interface Status
- PAN-DNS Cache Usage
- PAN-DNS End-to-End Response Time
- PAN-DNS FQDN Proxy Information
- PAN-OS Configuration Directory Usage
- PAN-OS Counters
- PAN-OS REST API Usage
- Panorama Admin Sessions
- Panorama Connection Information
- Panorama HA Health
- Panorama Log Reception Rate
- Panorama Logging Infra Health
- Plugin Dlp.Log
- Rasmgr.Log
- Reboot.Log
- Registered IP Addresses
- Reportd.Log
- Root Shell Command History
- Route Table Size
- Routing BFD Details
- Routing Resource
- Running-Config.Xml
- Satd.Log
- SD-WAN Details and Statistics
- SD-WAN Path Monitor Health
- SD-WAN Virtual Interface Rules
- Security Policy Usage and Hit Count
- Security Policy Usage and Hit Count
- Session Distribution
- Session Distribution Policy
- Session Meter
- Session Opening State
- Session Table Usage
- SMART Disk Information
- SMART Disk Information
- Software Component Debug Levels
- Software Component Status
- Software Log
- Software Update History
- SSL Decyrption Memory
- SSL Manager System Daemon State
- SSL Protocol Statistics
- Sslmgr.Log
- Sslvpn Access.Log
- Storage Engine Instance (Correlation)
- Storage Engine Instance (Management)
- Syslog System Log
- Syslog-Ng.Log
- System Capacity
- System Disk Details
- System Disk Utilization
- System Information
- System Jobs
- System Master Key Properties
- System Process Information
- System RAID
- System Resource Memory Statistics
- System State
- System statistics
- System Timezone and Configuration State
- System Timezone and Configuration State
- Timezone and Timestamp
- Traffic Blocked as Malware
- Transceiver Details
- Unit 42 Logs and Device Health Performance
- Unit 42 System Logs
- URL Cache Statistics
- URL Cloud Status
- User Group List
- User Group Mapping State
- User-ID Agent information
- User-ID Agent State
- User-ID Agent State
- User-ID Domain Map Information
- User-ID Redistribution Agent information
- User-ID Redistribution Certificate Expiration
- User-ID Server Monitor Statistics
- User-ID Terminal Server Agent information
- Var Pan Bradgent Log
- Virtual Interface Process State
- VLD Ingestion Statistics
- VLD Logs
- VM Interface Statistics
- VPN Flow Dump Logs
- VPN IKE SA Information
- WildFire Statistics and Status
- WildFire Statistics and Status
- XML Configuration Size
- Logs For Bradagent & Dp-Brdagent.Log & Brdagent.Log & Chassis-Brdagent.Log
- Configuration Daemon Log
- Console-Output.Log Chassis
- Console-Output.Log Non-Chassis
- Crash and Trace Files
- Crash and Trace Files
- Crash and Trace Files
- Current Application ID Version
- Data Plane Statistics
- Device Certificate Status
- Devsrv.Log
- Dnsproxy
- Configuration lock log
- Ehmon.Log
- Fips.Log
- Ikemgr-Ng.Log
- Ikemgr.Log
- Log Receiver and RAID Log
- Logs For Bradagent & Dp-Brdagent.Log & Brdagent.Log & Chassis-Brdagent.Log
- Md Detail.Log
- NTP Configuration
- Pan Comm 0.Log Chassis
- Pan Comm 0.Log Non-Chassis
- Pbp Latency.Log
- Php.Debug.Log
- Previous Application ID Version
- Sysdagent.Log
- System Log
- Useridd.Log
-
- ACC and Monitor Query History
- ARP Management Table
- Configuration Log Contents
- CTD Configuration State
- Device Certificate Status
- Device Certificate Status
- Asymmetric Network Traffic
- License Entitlements
- Managed Devices Licenses
- PAN-OS REST API Usage
- Routing Peers
- Rule Tagging
- Session Table Usage
- SSL Decrypt Configuration
- Support Licenses Installed
- System Timezone and Configuration State
- System Timezone and Configuration State
- Threatening SaaS Traffic
- Timezone and Timestamp
- VM Monitoring
- VM Plugin Usage Statistics
- WildFire Virus Threat Logs
-
- Application Statistics
- ARP Management Table
- Attackers
- Attacking Countries
- Brdagent.Log
- Content and Threat Detection State
- Correlated Events
- Correlated Events Details
- Credential Theft
- CTD Configuration State
- Decryption Usage
- Device Certificate Status
- Device Certificate Status
- DNS-Related Threat Logs
- Dynamic DNS
- File Identification
- Malware Sites
- Management Plane Statistics
- Non-Standard Port Usage
- PAN-DNS Threat Logs
- Parked Domains
- Phishing Sites
- Proxy Avoidance and Anonymizers
- Questionable Sites
- Session Table Usage
- System Timezone and Configuration State
- System Timezone and Configuration State
- Threats Permitted
- Timezone and Timestamp
- Top Application Usage
- Top Threat IDs
- Unknown Applications by Destination Address
- Unknown Applications by Destination Ports
- Unknown Sites
- Unknown TCP or UDP Traffic
Ms.Log
Extracts management server (ms.log) entries from the last hour using timestamp-based filtering, capturing management API activity, commit events, and inter-daemon messaging.
Metric Details
|
Category
|
Device Health and Performance
|
|
Every hour
| |
|
Telemetry Tier
|
Diagnostic
|
|
Equivalent CLI Command
|
LC_ALL=C grep -A1000000 "^$(date -d"1 hour ago" +"%Y-%m-%d %H"):..:.." /var/log/pan/ms.log | LC_ALL=C grep -oE "^.{3,500}" | tail -10000
|