topic Re: log forwarding to syslog | drops and queue in General Topics

log forwarding to syslog | drops and queue

FarkhanAliyev — Tue, 12 Aug 2025 10:43:18 GMT

Hi everyone,

Can anyone advise what's wrong here.

Issue with log forwarding to syslog PA 3250 running on 11.1.6-h10. Only few logs are being sent to server, others are dropped. Here is the flooding messages in the logrcvr log file:

2025/08/11 16:34:09 2025-08-11 16:34:09.382 +0400 Error: pan_logforward_enqueue_new(pan_logforward.c:2996): LOGFWD: enqueue task to syslog taskq(q_depth 0), log dropped
2025/08/11 16:34:09 2025-08-11 16:34:09.468 +0400 Error: pan_logforward_enqueue_new(pan_logforward.c:2996): LOGFWD: enqueue task to syslog taskq(q_depth 0), log dropped
2025/08/11 16:34:09 2025-08-11 16:34:09.498 +0400 Error: sendtcpsyslog(pan_syslog.c:1359): Reached max retry limit, ntotal: 0, errno: 11
2025/08/11 16:34:09 2025-08-11 16:34:09.498 +0400 Error: _pan_syslog(pan_syslog.c:1962): TCP send failure: data size: 1538, sent: 0, errno: 11

TCP port 514, switching to UDP dont help

Simple things like restarting log-receiver, mgmt, creating new syslog server and etc didn't help. We will probably open a case for this but if you know the possible solution will appreciate that.

Re: log forwarding to syslog | drops and queue

kiwi — Tue, 12 Aug 2025 11:55:42 GMT

Hi @FarkhanAliyev ,

You might be hitting an existing bug where syslog connections from the FW to the syslog server is not established.

The bug-report as far as I can see is still unclear for a fix version in 11.1.x

I'd recommend reaching out to TAC to confirm if you're hitting the exact same bug (PAN-255253) or if you're hitting an entirely different issue.

Kind regards,

-Kim.

Re: log forwarding to syslog | drops and queue

FarkhanAliyev — Tue, 12 Aug 2025 12:40:19 GMT

Thanks for your prompt. Just opened a ticket, will update here as we get reply.

Re: log forwarding to syslog | drops and queue

Icardi9_gs — Fri, 10 Oct 2025 13:23:13 GMT

Hi,

I am currently having the same issue. Were you able to resolve the problem? If so, could you please share your experience?

Re: log forwarding to syslog | drops and queue

kiwi — Fri, 10 Oct 2025 14:16:38 GMT

Hi @Icardi9_gs ,

If you're hitting PAN-255253 you might want to check out PAN-OS 11.2.8 where this issue has been addressed:

https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/pan-os-11-2-8-known-and-addressed-issues/pan-os-11-2-8-addressed-issues

Kind regards,

-Kim.