topic Re: How to set selective syslog server? in Log Forwarding Discussions

How to set selective syslog server?

Theerdam — Wed, 29 Sep 2021 11:39:40 GMT

Can I set palo alto to check if syslog server is up before forwarding the log, and if the main syslog server is down then forward log to another server?

I have issues that I need palo alto to not forwarding logs to both servers at the same time.

Re: How to set selective syslog server?

PavelK — Tue, 05 Oct 2021 04:33:38 GMT

Thank you for posting question @Theerdam

I was researching this topic and doing some verification. Regardless of PAN-OS version there can be up to 4 syslog servers configured in one syslog server profile, however there is no logic / connection check. Syslog server profile is sending logs to all targets simultaneously. One way to go around it would be to send all the logs to Virtual IP address of Load Balancer, then based on health check send logs to either of the real syslog server.

Kind Regards

Pavel

Re: How to set selective syslog server?

pchevveti — Thu, 18 Nov 2021 15:41:13 GMT

Hi, I have one query here.
Imagine the Syslog server is down for a few hours, and later once the syslog server is up again, will the firewall send fresh logs or the meantime logs as well ?

Re: How to set selective syslog server?

MP18 — Sat, 11 Mar 2023 19:36:29 GMT

@pchevveti

If the syslog server is down then as per my understanding firewall will store logs locally and once server is up it will send old new logs.

Regards

Mahesh