topic Re: PAN-OS logs in General Topics

PAN-OS logs

shahar.dorfman — Mon, 16 Dec 2024 16:28:08 GMT

I looking for the log file that tracks the IP addresses of devices that have connected to our Palo Alto Networks firewall.

I am interested in any logs that show source and destination IP addresses for network connections.

Could you please point me to the file path or location of these logs? If they are exported or stored in a specific directory, that information would be very helpful.

Re: PAN-OS logs

Brandon_Wertz — Mon, 16 Dec 2024 21:52:25 GMT

It's going to be in your "Global Protect" log type. You'll need to do some search strings to identify the successful login as well as using the "host ID" field. You're also going to be limited on how much storage you've allocated to this log type.

--edit-- If you're just simply referring to an administrator that's logged into your firewall those logs would be in the system logs.

Re: PAN-OS logs

shahar.dorfman — Tue, 17 Dec 2024 07:52:17 GMT

Thanks! Could you please refer me to the exact path of the log files? As I’m having a hard time finding them🙏

Re: PAN-OS logs

shahar.dorfman — Tue, 17 Dec 2024 10:42:28 GMT

Just clarifying - I'm looking for the log file that logs the IP that used http to connect to my PAN-OS.

Thanks in advanced!

Re: PAN-OS logs

Brandon_Wertz — Tue, 17 Dec 2024 13:57:23 GMT

@shahar.dorfman wrote:

Thanks! Could you please refer me to the exact path of the log files? As I’m having a hard time finding them🙏

From the GUI:

Monitor tab --> System logs

Re: PAN-OS logs

shahar.dorfman — Tue, 17 Dec 2024 14:05:05 GMT

Is there a way to read them directly from the file?

Re: PAN-OS logs

BPry — Tue, 17 Dec 2024 21:14:44 GMT

@shahar.dorfman,

Can you describe a bit more on what you're actually looking to do and why you're interested in reading them from the log files directly? That's a bit of an odd request; there's multiple ways to read the logs programmatically, send automated alerts when someone logs into the system, and so on without ever reading authd.log directly.