Is it possible to re-send system logs to a syslog server

s0lselcia — Tue, 20 Jun 2023 10:39:44 GMT

If this syslog server connection has been down, and I would like to send all previously unsent logs during that downtime to the syslog, is this possible?

Thanks in advance

Re: Is it possible to re-send system logs to a syslog server

aleksandar.astardzhiev — Tue, 20 Jun 2023 10:58:28 GMT

Hi @s0lselcia ,

As far as I am aware there is no easy way to do that...Especially if you are using UDP for syslog. If Syslog over UDP was used there is no way for the firewall to know if remote syslog server is up or down as there is no acknowledgment. I am not completely sure if TCP is used...In theory it should provide the necessary information for FW to know when exactly remote syslog stopped receiving logs, but I don't have real experiance if it will resume from that point or again from the moment TCP connection is re-established.

The only workaround I can think of is log export to SCP or FTP server - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clj3CAC (bottom of the page follow the steps for CLI export)

topic Re: Is it possible to re-send system logs to a syslog server in General Topics

Is it possible to re-send system logs to a syslog server

Re: Is it possible to re-send system logs to a syslog server