VM series log not detected in Azure Sentinel

nurulams0 — Thu, 10 Feb 2022 13:22:34 GMT

Here’s the problem statement:

1] If Syslog UDP 514 is configured in PAN FW on-prem and vm-series, There were missing logs in AZ Sentinel, Incomplete logs is experienced and there were packets fragmentation.

2] MS Sentinel support recommended to changed syslog transport UDP to TCP 514.

3] If Syslog TCP 514 is configured in PAN FW, On-prem able to send syslog in Azure Sentinel and confirmed from Azure sentinel Azure side.

However all VM-series logs were not detected in Azure Sentinel, although FW is sending syslog traffic.

topic VM series log not detected in Azure Sentinel in VM-Series in the Public Cloud

VM series log not detected in Azure Sentinel