topic Re: Need help in setting up the email alerts for the Pan firewalls. in General Topics

Need help in setting up the email alerts for the Pan firewalls.

nmsecteam — Tue, 05 Jun 2012 22:36:31 GMT

I am trying to setup email alerts when the device goes down or the interface goes down.

To complete this task, I had configured the email server and under the device tab -- log settings-- critical -- I set it to be forwarded to the email server.

Also when configuring the email server profile, under the custom log format, under system I chose the following fields

$severity$module$actionflags$object$time_generated

I am getting the alerts, but none of these alerts have the ip address or any device information. Does any one know, what fields I need to choose to get the device information like the hostname

Re: Need help in setting up the email alerts for the Pan firewalls.

UhMayYeah — Wed, 06 Jun 2012 04:34:04 GMT

Two Options:

Prominent option

> Choose the 'Display name' in the Email Server profile to reflect the Hostname/IP address.

Cryptic Option:

>You can choose the 'Serial No' field in the Custom Log Format "$serial" which is a distinctive identifer for every device.

Regards,

Re: Need help in setting up the email alerts for the Pan firewalls.

nmsecteam — Wed, 06 Jun 2012 15:55:57 GMT

Ameya,

I dont see the option for "display name/ip address". I only see, the serial no, which for me is not an ideal case scenario.

Praveen

Re: Need help in setting up the email alerts for the Pan firewalls.

UhMayYeah — Thu, 07 Jun 2012 01:06:21 GMT

Display name configured in the Email Server Profile which needs to be associated with the Log settings would show up in the "From:" field of the email notifications.

Eg:

Configure Email server profile say Test with Display name =Host name[Device>Server Profile> Email]

Associate this profile with the System Logs -Critical severity [Device>Log Settings> System >Critical]

You would receive email notifications with the from feild populated with the Host name

eg.From:Host-ABC <ak@xyz.com>

Please check the highlighted portion in this snapshot.

Refer https://live.paloaltonetworks.com/docs/DOC-2390

Regards,

Ameya