GlobalProtect

Where GlobalProtect keeps its logs

GlobalProtect logs to %LOCALAPPDATA%\Palo Alto Networks\GlobalProtect\PanGPA.log on Windows.

Paths are printed exactly as GlobalProtect writes them. Environment variables like %LOCALAPPDATA% and $XDG_STATE_HOME are never expanded, so a path can be pasted straight into a shell. Where a path differs between installer types or shipping flavours, each one is racked as its own card below - why that happens.

Finding your way around Windows.

How to turn on debug logging for GlobalProtect

1. Click the GlobalProtect icon, open the menu and choose Settings.
2. Open Troubleshooting and set Logging Level to Debug Logs or Dump Logs.
3. Windows (6.0 and later): For the service log, open Troubleshooting > Advanced > Logs and set Log type to PanGP Service and Debug Level to Debug.
4. Windows: Click Start, reproduce the issue, then click Stop.
5. Linux (5.1 and later): Run globalprotect set-log -l dump.

How to collect GlobalProtect logs

1. Windows and macOS: Open Settings > Troubleshooting and click Collect Logs.
2. Windows: Click Open Folder and attach GlobalProtectlogs.zip.
3. macOS: Attach GlobalProtectLogs.tgz from ~/Collect/.
4. Windows: If the app window will not open, run C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPSupport.exe.
5. macOS: If the app window will not open, run sh /Applications/GlobalProtect.app/Contents/Resources/gp_support.sh <save location>.
6. Linux: Run globalprotect collect-log (some versions spell it collect-logs) and attach the archive it writes under /home/<user>/.GlobalProtect/.