topic Re: Query on Syslog filter builder in General Topics

Query on Syslog filter builder

tamilvanan — Mon, 07 Mar 2022 16:12:12 GMT

Hi Folks,

We had configured to forward the system logs for severity of informational, medium, high and critical using filter builder. But we are receiving logs only for informational on our QRadar Syslog.

What is the supported format for System log forwarding in PA firewall, we can select only one severity type for each entry or multiple severity type filter for each entry.

Thanks in advance

Re: Query on Syslog filter builder

reaper — Thu, 10 Mar 2022 09:28:54 GMT

you should be able to pick multiple, but have you tried setting that top one to (severity neq low) ?

Re: Query on Syslog filter builder

steven_yorke — Thu, 24 Mar 2022 08:57:40 GMT

Have a similar issue with our device. It won't forward medium, high or critical events to the syslog server.

Re: Query on Syslog filter builder

MP18 — Fri, 25 Mar 2022 04:47:28 GMT

@tamilvanan

We have this config for syslog

system-infomational filter (severity eq informational)

system-low filter (severity eq low)

system-high filter (severity eq high

system-medium filter (severity eq medium )

We are getting all the logs to the syslog server

Regards