VM-Series Deployment Guide
    : VM-Series Firewall Startup and Health Logs on AWS
    Focus
    Download PDF
    Focus
    1. Home
    2. VM-Series
    3. VM-Series Deployment Guide
    4. Set Up the VM-Series Firewall on AWS
    5. Deploy the VM-Series Firewall on AWS
    6. VM-Series Firewall Startup and Health Logs on AWS
    Download PDF

    VM-Series Deployment Guide

    VM-Series Firewall Startup and Health Logs on AWS

    Table of Contents
    End-of-Life (EoL)

    VM-Series Firewall Startup and Health Logs on AWS

    View VM-Series firewall startup and health logs in AWS CloudWatch.
    To aid in debugging deployment issues, the VM-Series firewall provides system logs during the system startup. After the system boots successfully, the firewall can generate status messages for system events and can report changes in system resources as health status. Messages are logged to the VM-Series firewall console at /dev/ttyS0 and /dev/tty0.
    If you correctly configure your environment, you can also use the AWS CloudWatch service to view logs for VM-Series firewalls deployed in AWS.

    View VM-Series Firewall Logs in CloudWatch

    To view VM-Series firewall logs in CloudWatch, the firewall must, at minimum, be running the VM-Series plugin version that supports system messages, as noted in the Compatibility Matrix.
    • Ensure your AWS environment is up to date, and that Boto3 is available.
    • You must create an IAM role and policy that permits VM-Series firewalls to create a log group and a log stream in CloudWatch, and write log events to the log stream.
      To ensure that CloudWatch can display VM-Series firewall logs, your IAM role must include a policy that allows the following actions:
      "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"
    • Ensure the VM-Series plugin version supports firewall startup and health logs, as specified in the Compatibility Matrix.
    The VM-Series plugin includes a logging script that connects to the AWS CloudWatch service.
    1. The script creates the log group PaloAltoNetworksFirewalls. All VM-Series firewall instances in your deployment use this log group.
    2. The script creates a log stream unique to your VM-Series firewall. Each of your firewalls configure CloudWatch has its own log stream based on the firewall’s instance ID.
    3. When an event is logged, the log message and timestamp are sent to the log group using the firewall’s log stream.

    VM-Series Firewall System Messages

    To aid in debugging, the VM-Series firewall provides system messages during the system startup. After the system starts, the firewall can generate status messages to report system health. Critical health events or errors are always reported, and you can enable periodic health messages to log the system status at an interval you choose.

    Message Format

    The log message format is as follows:
    Log level : Resource : State : Details
    • Log level
      • CRITICAL
      • ERROR
      • INFO
      Each CRITICAL or ERROR event has a unique MSGID in the logs. If you have enabled Periodic Health Messages, the MSGID helps you distinguish new CRITICAL or ERROR messages from unresolved issues you have seen before.
      Log level : Resource : State : MSGID : Details
      A health status ERROR will include an error code. For example:
      ERROR : HA : DOWN : MSGID : HA status <>
    • Resource
      • BOOTSTRAP
      • CONTENT
      • HA
      • INTERFACE
      • LICENSE
      • MGMTINTERFACE
      • PANORAMA
      • PANOS
      • PERIODIC_STATUS
      • SYSTEM
    • State
      • START/READY
      • COMPLETE/FAIL
      • UP/DOWN
      • HEALTHY/UNHEALTHY
    • Details—The details are typically passed on from the resource.

    System Startup Messages

    The following list is loosely ordered according to system startup events. However, the order can change as events occur.
    • Base OS start and network initialization
      INFO : SYSTEM : START : Palo Alto Networks Firewall Initializing
    • PAN-OS bootstrap
      INFO : BOOTSTRAP : COMPLETE : Firewall Successfully Bootstrapped
      or
      ERROR : BOOTSTRAP : FAIL : MSGID : Firewall bootstrap failureError - <>
    • Management interface swap (if applicable)
      INFO : MGMTINTERFACE : COMPLETE : Firewall Interface Swap Configured
      or
      ERROR : MGMTINTERFACE : MSGID : COMPLETE : Firewall Interface Swap failed <>
    • PAN-OS start
      INFO : PANOS : START : Firewall version <x,yz> Starting
      or
      CRITICAL : PANOS : FAIL: MSGID : Firewall failed to start version <x,yz>
      INFO : SYSTEM : START : Palo Alto Networks Firewall Initializing
    • Load license
      INFO : LICENSE : COMPLETE : Firewall successfully licensed <model>
      or
      CRITICAL : LICENSE : FAIL : MSGID : Firewall failed to license <reason>
    • Load content
      INFO : CONTENT : COMPLETE : Firewall content version <> loaded.
      or
      ERROR : CONTENT : FAIL : MSGID : Firewall content version <> failed to load.
    • Dataplane processes up, and auto commit
      INFO : COMMIT : COMPLETE : Auto-commit job successful.Firewall license - <model>
      or
      CRITICAL : COMMIT : FAIL: Auto-commit job failed <reason>.
    • Panorama registration, Panorama connected (if applicable)
      INFO : PANORAMA : COMPLETE: Connected to Panorama <IP>
      or
      ERROR : PANORAMA : FAIL : MSGID: Failed to connect to Panorama <IP>
    • System ready and interfaces up
      INFO : SYSTEM : READY : Firewall ready to process traffic.Firewall license - <model>

    Health Status Messages

    Health messages report the status of a resource. After a successful system startup, all system health events are set to Up, and subsequent state changes are reported. As mentioned in Message Format, health status ERROR messages will contain a status code. In the sample messages below, <> is a place holder for the status code.
    If an administrator performs an intentional shutdown, the shutdown is not reported.
    • CloudLoggingConnectionFailed
      If there are no CloudWatch logs (due to connection failure) you can check the PAN-OS log vm_cloud_logging.log.
    • Data path interface failure
      Message: ERROR : INTERFACE : DOWN : MSGID : Interface <> went down
    • HA interface failure—This message applies to a single firewall; it does not imply anything about the health of the HA pair. For example, the primary firewall state can be UP when the secondary is down.
      INFO : HA : UP : HA status <>
      or
      ERROR : HA : DOWN : MSGID : HA status <>
    • Peer HA interface failure—This message is the status of the peer in the HA pair.
      ERROR : PEER_HA : UP : Peer HA status <>
      or
      ERROR : PEER_HA : DOWN : MSGID : Peer HA status <>
    • Panorama Connectivity
      ERROR : PANORAMA : DOWN : MSGID : Lost Panorama <IP> connectivity
      or
      INFO : PANORAMA : UP : Panorama <IP> connected

    Periodic Health Messages

    When there are no health changes, you can choose to generate a periodic health status message. By default, the cloud logging interval is 0 (no messages).
    For example, if your status remains up, the message is:
    INFO : PERIODIC_STATUS : HEALTHY : All resources healthy
    If unresolved health failures exist, the periodic message reprints them. As mentioned in Message Format, the MSGID helps you distinguish between errors when you are viewing periodic logs.
    INFO : PERIODIC_STATUS : UNHEALTHY : Resources unhealthy
    ERROR : INTERFACE : DOWN : MSGID : Interface ethernet1/2 down
    • Set the periodic interval from 10 to 300 seconds
      • CLI:
        request plugins vm_series cloud-logging interval <seconds>
      • XML API:
        api/?type=op&cmd=<request>
  <plugins>
    <vm_series>
      <cloud-logging>
        <interval>seconds</interval>
      </cloud-logging>
     </vm_series>
   </plugins>
</request>
    • Display the cloud logging interval—Use the CLI to display the current interval in seconds.
      show plugins vm_series cloud-logging interval
    • Disable periodic logging—Use the CLI to turn off periodic logging.
      request plugins vm_series cloud-logging interval 0

    © 2025 Palo Alto Networks, Inc. All rights reserved.