topic Re: link-change still informational severity? in General Topics

link-change still informational severity?

TonyDeHart — Mon, 17 Apr 2023 18:28:59 GMT

Can someone explain to me the rational behind allowing an interface to drop and having the link-change log a down state and yet have it be INFORMATIONAL severity level? I saw an old question about this and it seems somewhat ridiculous? We had filtering on higher severity levels and had a circuit drop and never got the alert and then realized why.

Just curious if anyone understands the reasoning behind this?

Re: link-change still informational severity?

JayGolf — Thu, 20 Apr 2023 20:28:29 GMT

Hi @TonyDeHart ,

Could you share a screenshot of the alert and blur any IPs/Names? I typically have seen "Critical" for alerts such as VPN tunnel down or interface being down on the Palo. Here is a link to the system logs doc.

Re: link-change still informational severity?

TonyDeHart — Thu, 20 Apr 2023 20:50:30 GMT

This is straight out of the system log from a link dropping on us. Bonus for the HSCI being in there. 🙂

Our alerting was ignoring information as far as getting a text/email so we never knew until other services dropped that the link had failed on the firewall.

Re: link-change still informational severity?

Raido_Rattameister — Thu, 20 Apr 2023 20:50:57 GMT

Yeah those events are informational.

I have dedicated syslog/email alert set up under "Device > Log Settings > System" with filter ( subtype eq port ).

You can also be more specific with "( subtype eq port ) and ( eventid eq link-change )" to notify you.

Re: link-change still informational severity?

TonyDeHart — Fri, 21 Apr 2023 11:37:57 GMT

Thanks. That is essentially what I did after I discovered this but I was more curious what, if anything, is the rational behind a port going doing being informational? Not sure if anyone from Palo Alto chimes in but how is this not a more critical type of alert?

Re: link-change still informational severity?

Raido_Rattameister — Fri, 21 Apr 2023 12:30:12 GMT

It would be nice if alert severities for different events could be adjusted by admin.

For example in tiny office that has no switch and workstations connect directly to firewall it would be noisy if every workstation reboot causes critical alert in firewall.

On the other hand if firewall is in the datacenter then it is definitely event to pay attention to.