topic Re: Syslog to one or two servers with default and custom log format in Next-Generation Firewall Discussions

Syslog to one or two servers with default and custom log format

MikeSangray2019 — Tue, 01 Jul 2025 14:08:11 GMT

Hey all, I am wondering if this is possible. I understand this duplicates logging, but hopefully it's short-term.

I need to send syslog to either one server in default and custom log formats or send to two syslog servers one in default and the other in custom log format. It seems like the profile only allows for either default or custom log format, and I can only apply one profile per policy.

Really seems like an either/or situation, but I'm hoping I'm missing something.

Re: Syslog to one or two servers with default and custom log format

BPry — Fri, 04 Jul 2025 05:21:39 GMT

@MikeSangray2019,

You can't do this in a single syslog server profile, but that doesn't really matter. I would create one "Syslog-Default" and "Syslog-Custom" and then perform any modifications that you need to on the profile. PAN-OS will allow you to have two profiles with the same syslog server address/fqdn specified, so you can do this on a single server.

You would then modify your log-settings or log-forwarding profiles as needed and simply include both syslog profiles that you have created. This will allow you to see how both would come across and customize as needed.

Re: Syslog to one or two servers with default and custom log format

MikeSangray2019 — Thu, 10 Jul 2025 14:23:26 GMT

This worked. Confusion here was around Device -> Server Profiles -> Syslog vs Objects -> Log Forwarding.