ML/RE- Split /PALogs per serial# of firewall in the case of forwarding logs from Panorama

lychiang — Thu, 02 Mar 2023 18:40:29 GMT

UseCase

In the ML or RE case, where Expedition is configured as syslog server , and you are forwarding traffic logs from Panorama to Expedition, by default, the logs will be saved using Panorama_IP . The solution below provides steps on how to split the logs per serial# of the firewall.

Solution

Split the logs per FW/Serial number by following below steps:

Step 1. Edit your rsyslog.conf file

Replace below line:

$template DynaTrafficLog,"/PALogs/%FROMHOST-IP%/%HOSTNAME%traffic%$YEAR%%$MONTH%%$DAY%_last_calendar_day.csv"

to below ones:

set $!SERIAL = field($msg,",",2);
$template DynaTrafficLog,"/PALogs/%FROMHOST-IP%/%$!SERIAL%/%$!SERIAL%%HOSTNAME%_traffic%$YEAR%%$MONTH%%$DAY%_last_calendar_day.csv"

The intention of the above configuration is to create a folder with your Panorama IP and subfolders for each FW/Serial number.

Step 2. Restart the syslog service

Issue below command:

service rsyslog restart

For your reference, next Expedition releases will include a set of rsyslog configuration example files on the path /var/www/html/OS/rsyslog folder .

article ML/RE- Split /PALogs per serial# of firewall in the case of forwarding logs from Panorama in Expedition Articles

ML/RE- Split /PALogs per serial# of firewall in the case of forwarding logs from Panorama

UseCase

Solution