PaloAlto CLI command for troubleshooting

General Command----

show system info                   //shows the uptime, serial number, ...

show system environmentals         //e.g. power supply failures

show ntp

show session info                  //packet rate, number of sessions, fastpath active, etc.

show session id <id>

show interface { all | <interface-name> }

show routing route                 //routing table (all routes)

show routing fib                   //forwarding table (only used routes)

show routing protocol <protocol> ...

show arp { all | <interface-name> }

show neighbor interface { all | <interface-name> }   //IPv6 neighbor cache

show mac all                       //only with layer 2 interfaces

show jobs all

show jobs id <id>

show running resource-monitor      //resource statistics

show system resource follow        //="top", CPU usage and processes

show system disk-space             //="df -h"

debug software restart <service>   //Restart a certain process

request restart system             //Reboot the whole device

FW Session--

show system statistics application

show system statistics session

Routing debug--

debug routing pcap <routing-protocol> on

debug routing pcap show

debug routing pcap <routing-protocol> view

debug routing pcap <routing-protocol> off

debug routing pcap <routing-protocol> delete

MGMT logs---

less mp-log ?

less mp-log dnsproxyd.log

tail follow yes mp-log dhcpd.log

tail follow yes mp-log routed.log

view the traffic from the management port at least two console connections are needed. The first one executes the tcpdump command (with “snaplen 0” for capturing the whole packet, and a filter, if desired),

tcpdump snaplen 0 filter "port 53"

while the second console follows the live capture:

view-pcap follow yes mgmt-pcap mgmt.pcap

Test traffic can be generated with a third console session, e.g.:

Ping host webernetz.net

Later on, the pcap file can be moved to another computer with the following command:

scp export mgmt-pcap from mgmt.pcap to <username@host:path>

Alternatively, tftp can be used:

tftp export mgmt-pcap from mgmt.pcap to <host>