topic logging for external dynamic lists? in Next-Generation Firewall Discussions

logging for external dynamic lists?

rjfoster — Tue, 14 Jan 2025 22:55:05 GMT

Is there any logging for EDLs? I am looking for things like:

a change in the EDL was detected
errors in the EDL (invalid IPs or URLs)
EDL is too large / too many entries

It would be great if I could alert on any of these.

Re: logging for external dynamic lists?

mshekh — Wed, 15 Jan 2025 02:04:23 GMT

You can refer the system logs to check the status of EDL refresh, but it will not give the exact error if IPs or URLs are invalid in EDL.

Regarding teh EDL is too large / too many entries, you will see the error in system logs.

You can refer the below doc related to formatting guidelines.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/formatting-guidelines-for-an-external-dynamic-list

Best Regards,

Mohammad Talib

Re: logging for external dynamic lists?

PavelK — Wed, 15 Jan 2025 12:12:29 GMT

Hello @rjfoster

only to expand on answer given by @mshekh. Once you find EDL related errors in System log you want to get alerts, you can set up custom alerting from: Device > Log Settings > System > Add > Filter Builder:

Contains 'EDL' is a bit too generic and will be noisy. I am using it here only as an example 🙂

Kind Regards

Pavel

Re: logging for external dynamic lists?

rjfoster — Thu, 16 Jan 2025 16:28:22 GMT

Thanks for the info. I was hoping there was a place to get more details. In particular, if a entry is bad, the firewall should provide details. Logging seems to be a strength for traffic and security--I was hoping system-level logging would be as detailed.

-r