====== HA System Logs ======

===== Critical ======
<code>( subtype eq ha ) and ( severity eq critical )</code>
Panorama
<code>( eventid eq connect-change ) and ( description contains 'HA1 connection down' )</code> 
Firewall
<code>( eventid eq dataplane-down ) and ( description contains 'HA Group 1: Dataplane is down: too many dataplane processes exited' )</code>
<code>( eventid eq dataplane-down ) and ( description contains 'HA Group 1: Dataplane is down: dataplane exit failure' )</code>
<code>( eventid eq connect-change ) and ( description contains 'HA Group 1: HA1 connection down' )</code>
<code>( eventid eq connect-change ) and ( description contains 'HA Group 1: Control link running on HA1-Backup connection' )</code>
<code>( eventid eq connect-change ) and ( description contains 'HA Group 1: All HA1 connections down' )</code>
<code>( eventid eq state-change ) and ( description contains 'HA Group 1: Moved from state Active-Primary to state Tentative' )</code>
<code>( eventid eq state-change ) and ( description contains 'HA Group 1: Moved from state Active-Primary to state Non-Functional' )</code>
<code>( eventid eq state-change ) and ( description contains 'HA Group 1: Moved from state Active-Secondary to state Non-Functional' )</code>
Panorama Secondary
<code>( eventid eq state-override ) and ( description contains 'HA peer determined to be Active through managed devices; staying in Passive state' )</code>
Panorama Secondary
<code>( eventid eq state-override ) and ( description contains 'HA peer determined to be Active through managed devices; going to Passive state' )</code>
Firewall Active Secondary
<code>( eventid eq split-brain ) and ( description contains 'HA Group 1: Going to Active-Secondary state due to split-brain recovery (split-brain duration: 448s)' )</code>
Panorama Secondary
<code>( eventid eq split-brain ) and ( description contains 'Going to Passive state due to split-brain recovery (split-brain duration: 4s)' )</code>
Panorama Primary
<code>( eventid eq peer-split-brain ) and ( description contains 'Staying in Active state after split-brain recovery (split-brain duration: 5979s)' )</code>
Firewall Primary
<code>( eventid eq peer-split-brain ) and ( description contains 'HA Group 1: Staying in Active-Primary state after split-brain recovery (split-brain duration: 6s)' )</code>
<code>( eventid eq peer-sync-failure ) and ( description contains 'HA Group 1: Can\'t synchronize control plane data; some state may be lost on switchover' )</code>
Firewall Secondary
<code>( eventid eq peer-compat-mismatch ) and ( description contains 'HA Group 1: Peer device session load sharing configuration not matching' )</code>
<code>( eventid eq ha2-keep-alive ) and ( description contains 'HA Group 1: Local HA2 keep-alive down' )</code>
<code>( eventid eq ha2-keep-alive ) and ( description contains 'HA Group 1: All HA2 keep-alives are down; ignoring failure in HA2-keep-alive monitor hold' )</code>
<code>( eventid eq ha2-keep-alive ) and ( description contains 'HA Group 1: All HA2 keep-alives are down; turning off state-synchronization' )</code>
<code>( eventid eq ha2-keep-alive ) and ( description contains 'HA Group 1: Peer HA2 keep-alive down' )</code>
<code>( eventid eq ha2-keep-alive ) and ( description contains 'HA Group 1: Local HA2 keep-alive down' )</code>
<code>( eventid eq ha2-link-change ) and ( description contains 'All HA2 links down' )</code>
<code>( eventid eq ha2-link-change ) and ( description contains 'HA2 link down' )</code>
<code>( eventid eq ha3-link-change )</code>
<code>( eventid eq path-monitor-down ) and ( description contains 'HA Group 1: Path group \'GRPNAME\' failure; all destination IPs are down' )</code>
<code>( eventid eq config-failure ) and ( description contains 'HA Group 10: Running configuration not synchronized after failure' )</code>


===== High ======
<code>( subtype eq ha ) and ( severity eq high )</code>
<code>( eventid eq ha1-link-change ) and ( description contains 'HA1-Backup link down' )</code>
<code>( eventid eq ha1-link-change ) and ( description contains 'HA1-Backup peer link down' )</code>
<code>( eventid eq ha2-link-change ) and ( description contains 'HA2 peer link down' )</code>
<code>( eventid eq ha2-link-change ) and ( description contains 'HA2-Backup peer link down' )</code>
<code>( eventid eq state-change ) and ( description contains 'Moved from state Passive to state Active' )</code>
<code>( eventid eq state-change ) and ( description contains 'HA Group 1: Moved from state Active-Primary to state Active-Secondary' )</code>
<code>( eventid eq state-change ) and ( description contains 'HA Group 1: Moved from state Active-Secondary to state Active-Primary' )</code>
<code>( eventid eq state-change ) and ( description contains 'HA Group 1: Moved from state Non-Functional to state Tentative' )</code>
<code>( eventid eq connect-change ) and ( description contains 'HA Group 1: HA1-Backup connection down' )</code>
<code>( eventid eq session-synch ) and ( description contains 'HA Group 1: Ignoring session synchronization due to HA2-unavailable' )</code>
<code>( eventid eq session-synch ) and ( description contains 'HA Group 1: Ignoring session synchronization due to compatibility mismatch' )</code>
<code>( eventid eq config-not-synch ) and ( description contains 'HA Group 1: Commit on local device with running configuration not synchronized; synchronize manually' )</code>
<code>( eventid eq config-not-synch ) and ( description contains 'Commit on peer device with running configuration not synchronized; synchronize manually' )</code>
<code>( eventid eq path-monitor-down ) and ( description contains 'HA Group 1: Path group \'GRPNAME\' destination IP \'8.8.4.4\' is down' )</code>


===== Informational ======
<code>( subtype eq ha ) and ( severity eq informational )</code>

<code>( eventid eq state-change ) and ( description contains 'Moved from state Initial to state Active' )</code>
<code>( eventid eq state-change ) and ( description contains 'Moved from state Initial to state Passive' )</code>
<code>( eventid eq state-change ) and ( description contains 'Moved from state Active to state Suspended' )</code>
<code>( eventid eq state-change ) and ( description contains 'Moved from state Passive to state Suspended' )</code>
<code>( eventid eq state-change ) and ( description contains 'HA Group 1: Moved from state Tentative to state Active-Secondary' )</code>
<code>( eventid eq state-change ) and ( description contains 'HA Group 1: Moved from state Active-Secondary to state Suspended' )</code>
<code>( eventid eq state-change ) and ( description contains 'HA Group 1: Moved from state Initial to state Active-Primary' )</code>
<code>( eventid eq state-change ) and ( description contains 'HA Group 1: Moved from state Non-Functional to state Active-Primary' )</code>
<code>( eventid eq state-change ) and ( description contains 'HA Group 1: Moved from state Active-Primary to state Suspended' )</code>

<code>( eventid eq connect-change ) and ( description contains 'HA Group 1: HA1 connection up' )</code>
<code>( eventid eq connect-change ) and ( description contains 'HA Group 1: HA1-Backup connection up' )</code>
<code>( eventid eq connect-change ) and ( description contains 'HA Group 1: Control link running on HA1 connection' )</code>
<code>( eventid eq peer-compat-match ) and ( description contains 'HA Group 1: Peer device configuration now compatible' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'HA Group 1: Application Content version now matches' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'HA Group 1: Threat Content version now matches' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'HA Group 1: Anti-Virus version now matches' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'HA Group 1: URL Database version now matches' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'HA Group 1: URL Vendor version now matches' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'HA Group 1: Global Protect Client Software version now matches' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'HA Group 1: URL Database version now matches' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'HA Group 1: VPN Client Software version now matches' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'HA Group 1: Application Content version mismatch due to device update' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'HA Group 1: Threat Content version mismatch due to device update' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'HA Group 1: Anti-Virus version mismatch due to device update' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'URL Vendor version now matches' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'Build Release version now matches' )</code>
<code>( eventid eq peer-version-match ) and ( description contains 'Peer device running a compatibile but different version 8.1.10' )</code>
Panorama
<code>( eventid eq peer-version-match ) and ( description contains 'Application Content version mismatch due to device update' )</code>
Panorama
<code>( eventid eq peer-version-match ) and ( description contains 'Application Content version now matches' )</code>
Panorama
<code>( eventid eq peer-version-match ) and ( description contains 'Anti-Virus version mismatch due to device update' )</code>
Panorama
<code>( eventid eq peer-version-match ) and ( description contains 'Anti-Virus version mismatch due to device update' )</code>
<code>( eventid eq config-not-synch ) and ( description contains 'HA Group 1: Commit on local device succeeded; configuration-synchronization disabled, running configuration not synchronized to peer' )</code>
<code>( eventid eq preempt ) and ( description contains 'HA Group 1: Going to Active-Secondary state due to preemption' )</code>
<code>( eventid eq preempt ) and ( description contains 'Going to Passive state due to preemption' )</code>
<code>( eventid eq session-synch ) and ( description contains 'HA Group 1: Starting session synchronization with peer' )</code>
<code>( eventid eq session-synch ) and ( description contains 'HA Group 1: Starting session synchronization with peer on slots 1 ' )</code>
<code>( eventid eq session-synch ) and ( description contains 'HA Group 1: Completed session synchronization with peer' )</code>
<code>( eventid eq session-synch ) and ( description contains 'HA Group 1: Session synchronization with peer never completed; HA1-peer-disconnected' )</code>
<code>( eventid eq session-synch ) and ( description contains 'HA Group 1: Session synchronization with peer never completed; HA2-unavailable' )</code>
<code>( eventid eq ha2-keep-alive ) and ( description contains 'HA Group 1: Local HA2 keep-alive up' )</code>
<code>( eventid eq ha2-keep-alive ) and ( description contains 'HA Group 1: Peer HA2 keep-alive up' )</code>
<code>( eventid eq ha1-link-change ) and ( description contains 'HA1 link up' )</code>
<code>( eventid eq ha1-link-change ) and ( description contains 'HA1 peer link up' )</code>
<code>( eventid eq ha1-link-change ) and ( description contains 'HA1-Backup link up' )</code>
<code>( eventid eq ha1-link-change ) and ( description contains 'HA1-Backup peer link up' )</code>
<code>( eventid eq ha2-link-change ) and ( description contains 'HA2 link up' )</code>
<code>( eventid eq ha2-link-change ) and ( description contains 'HA2 peer link up' )</code>
<code>( eventid eq ha2-link-change ) and ( description contains 'HA2-Backup link up' )</code>
<code>( eventid eq ha2-link-change ) and ( description contains 'HA2-Backup peer link up' )</code>
<code>( eventid eq ha3-link-change ) and ( description contains 'HA3 link up' )</code>
<code>( eventid eq ha3-link-change ) and ( description contains 'HA3 peer link up' )</code>