topic Re: Firewall is not forwarding logs to the Syslog server in General Topics

Firewall is not forwarding logs to the Syslog server

renzanjo11 — Mon, 12 Aug 2024 08:50:01 GMT

Hi everyone!

I am kind of bummed on why my syslog configuration is not taking effect.

I have 2 pairs of firewall, PRD(2 firewalls) and DR(2 firewalls). Both are in HA setup and managed by Panorama. My syslog configuration in DR and PRD are just the same. Same server, same settings. For some reason, the syslog in my PRD is not working. So mysterious.

I checked the CLI and it appears it is indeed listening on port 514. My PRD Firewalls are new ones coz I migrated from JUNOS to PANOS.

I use my management for my syslog forwarding.

Is there any thing I missed?

I did everything here correctly: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/use-syslog-for-monitoring/conf...

You can see the output of my checking on the PDF File attached.

Thank you guys in advance!

Re: Firewall is not forwarding logs to the Syslog server

PavelK — Tue, 13 Aug 2024 05:38:45 GMT

Hello @renzanjo11

from screen shots you provided your configuration looks correct.

Could you try to restart management service: debug software restart process management-server. Management service will also restart log receiver service. If it still does not work after management process restart could you please share PAN-OS version firewall is running? Could you also take pcap on management interface?

Kind Regards

Pavel

Re: Firewall is not forwarding logs to the Syslog server

renzanjo11 — Tue, 20 Aug 2024 06:44:35 GMT

Hi @PavelK ,

Pcap on the management interface means TCPdump right?

If yes, I also included that on my attachment. the image below the syslog forwarding profile configuration.

Regards,

Renz

Re: Firewall is not forwarding logs to the Syslog server

PavelK — Tue, 20 Aug 2024 23:33:25 GMT

Hello @renzanjo11

thank you for reply.

From the output of tcpdump it looks like that syslog traffic is being sent out. Are you able to confirm that your syslog server is receiving traffic? Is there any Firewall / ACL in between?

Kind Regards

Pavel