topic SYSTEM ALERT : high : Syslog connection established to server in General Topics

SYSTEM ALERT : high : Syslog connection established to server

${userLoginName} — Thu, 07 Nov 2013 13:21:15 GMT

I have mail notifications enabled for high and critical system logs. Because of this, I receive the following mail multiple times a day:

SYSTEM ALERT : high : Syslog connection established to server['AF_INET.10.0.0.49:514.']

domain: 1

receive_time: 2013/11/07 14:01:28

serial: 00xxxxxxxxxx

seqno: 14814

actionflags: 0x0

type: SYSTEM

subtype: syslog

config_ver: 0

time_generated: 2013/11/07 14:01:28

vsys:

eventid: syslog-conn-status

object:

fmt: 0

id: 0

module: mgmt

severity: high

opaque: Syslog connection established to server['AF_INET.10.0.0.49:514.']

I don't think that an established session to my syslog server is high prio? Anyone else seeing this?

System info:

Model: PA-VM

VM License: VM-100

Software Version: 6.0.0-b40

I am not posting this in the warsaw section because I had this problem before on 5.0.x

Kind regards,

Bob

Re: SYSTEM ALERT : high : Syslog connection established to server

Rene — Thu, 03 Apr 2014 09:09:52 GMT

Hi Bob,

I have exactly the same and found an article that describes it was an issue in 6.0.0.

So I upgraded to 6.0.1 on the Panorama but I still saw these messages.

Now I'm updating the local devices from 6.0.0 to 6.0.1 and hopefully the messages will disappear.

Rene

Re: SYSTEM ALERT : high : Syslog connection established to server

HULK — Thu, 03 Apr 2014 15:13:47 GMT

Hello Bdeschut,

These messages are seen now due to new enhancements in 6.0 related to Syslog over TCP or SSL. However, the message is incorrectly being sent once every hour. That will be addressed in 6.0.1 (reference addressed issue id 60816 ).

Thanks

Re: SYSTEM ALERT : high : Syslog connection established to server

${userLoginName} — Fri, 04 Apr 2014 11:04:25 GMT

6.0.1 has already been released if I am correct? Did you mean 6.0.2?

Re: SYSTEM ALERT : high : Syslog connection established to server

prb — Fri, 04 Apr 2014 12:59:33 GMT

Bob,

6.0.1 release notes has the bug in addressed issues.

60816—Following an upgrade to PAN-OS 6.0.0, syslog connection status warnings for

all defined syslog connections appeared in the system log every hour and were

categorized as critical. This was caused by a scheduled hourly rotation of the syslog-ng

log file, during which the syslog-ng daemon would restart. This issue has been fixed by

adding a condition to the log file rotation process requiring the log file to be 10 MB or

more and the connection status warning will only be seen once every few months.

Rene,

Might be file is over 10 MB?

Or is not fixed? Or doesn't apply to Panorama?

Re: SYSTEM ALERT : high : Syslog connection established to server

HULK — Fri, 04 Apr 2014 13:04:43 GMT

Hello Bdeschut,

it has been fixed on 6.0.1.

Thanks

Re: SYSTEM ALERT : high : Syslog connection established to server

TRisec — Fri, 23 May 2014 12:39:28 GMT

Hello

We are running on PanOS 6.0.2 and the message is still send several times a day. If it was fixed in 6.0.1 it seams the bug is back again.

Regards and thanks for any update

Ralf Cz.