topic Re: Palo Alto Syslog severity level compare to Syslog Protocol RFC 5424 in General Topics

Palo Alto Syslog severity level compare to Syslog Protocol RFC 5424

Amir.Borjian — Thu, 26 Feb 2015 15:17:44 GMT

Hi guys,

Do you know how Palo Alto interpret the standard Syslog protocol severity;

RFC 5424 The Syslog Protocol

Numerical Severity

0 Emergency: system is unusable

1 Alert: action must be taken immediately

2 Critical: critical conditions

3 Error: error conditions

4 Warning: warning conditions

5 Notice: normal but significant condition

6 Informational: informational messages

7 Debug: debug-level messages

kattaullah — Thu, 26 Feb 2015 17:02:52 GMT

Hello Amir

The syslog severity is based on the log type and contents. Below are the details

Log Type Severity Syslog Severity

TRAFFIC INFO

CONFIG INFO

THREAT/SYSTEM –Informational INFO

THREAT/SYSTEM – Low NOTICE

THREAT/SYSTEM – Medium WARNING

THREAT/SYSTEM – High ERROR

THREAT/SYSTEM – Critical CRITICAL

Hope that helps.

Regards

Khan

Note: Please mark any helpful or correct answers.

Amir.Borjian — Thu, 26 Feb 2015 17:11:30 GMT

Thanks Khan,

I would say it's sort of a correlation between them which is helpful in the UNIX environment.

Just checked Splunk and the severity levels are identical.

Thanks again.

Amir