Issue in the syslog message format in Palo Alto 6 beta 1

NHorsch — Fri, 06 Dec 2013 14:28:28 GMT

Hello,

I am currently on Palo Alto v 6.0.0-b23 and facing an issue with the format of syslog message.

if we pass the same malicious file through Palo Alto device, syslog message forwarded by Palo Alto v5.0.6 and v6.0 beta are different. Palo Alto 5.0.6 forwards threat name and ID while Palo Alto 6 beta forward threat ID twice.

Log on Palo Alto 6.0

Dec 05 22:38:41 10.208.35.87 Dec 5 22:36:06 PA-VM 1,2013/12/05 22:36:06,007000001148,THREAT,virus,1,2013/12/05 22:36:01,xx.xx.xx.xx,xx.xx.xx.xx,0.0.0.0,0.0.0.0,Test,,,ftp,vsys1,Trust,Untrust,ethernet1/1,ethernet1/2,Log Forwarding,2013/12/05 22:36:06,38355,1,49512,53627,0,0,0x0,tcp,deny,"filename",2001508(2001508),any,medium,server-to-client,0,0x0,192.0.0.0-192.255.255.255,192.0.0.0-192.255.255.255,0,,0,,,

Log on Palo Alto 5.0.6

May 2 06:33:42 10.102.102.45 1,2013/05/02 06:33:42,0006C111278,THREAT,virus,1,2013/05/02 06:33:36,xx.xx.xx.xx,xx.xx.xx.xx,,,rule2,,,ftp,vsys1,trust,trust,ethernet1/2,ethernet1/1,server-1,2013/05/02 06:33:41,9761,1,32277,44445,0,0,0x80000000,tcp,deny,"filename",Trojan/Win32.Loring.a(2001508),any,medium,server-to-client,81,0x0,192.0.0.0-192.255.255.255,192.0.0.0-192.255.255.255,0,

Is this change intentional or will it be fixed in the GA version or already fixed in the beta 4?

Re: Issue in the syslog message format in Palo Alto 6 beta 1

goku123 — Fri, 06 Dec 2013 16:07:45 GMT

Please report this issue to the Beta support alias for investigation at : betasupport@paloaltonetworks.com

topic Issue in the syslog message format in Palo Alto 6 beta 1 in General Topics

Issue in the syslog message format in Palo Alto 6 beta 1

Re: Issue in the syslog message format in Palo Alto 6 beta 1