topic Re: Recommend a syslog server for PA Firewall in General Topics

Recommend a syslog server for PA Firewall

Sobolenko — Sun, 14 Jun 2015 20:47:18 GMT

Hello,

Can anyone recommend a FREE syslog server that would be able to understand well PA Firewall logs, store them and if possible, provide simple reporting.

I currently tried:

Splunk - good software, but free version has limits and will be not enough for my environment

Sawmill - also a good product, but it's not really a syslog, it requires existing syslog server to send information to it for analysis and can process only traffic and threat log

Kiwi - good syslog server, but I don't know if it will be able to handle syslogs from our 5050 device. Does anyone tried it in Enterprise environment?

AlientVault - still working on it if I can send syslogs to it.

Any information is appreciated.

Main idea is to have an additional source for log forwarding instead of having them only on the firewall itself. Csv export is also configured to SCP server.

Thanks,

Val

Re: Recommend a syslog server for PA Firewall

lewis — Mon, 15 Jun 2015 13:18:17 GMT

We use Kiwi in an Enterprise environment with no issue. We are running a 5020

Re: Recommend a syslog server for PA Firewall

Sobolenko — Tue, 16 Jun 2015 00:55:43 GMT

Thanks for reply lewis.

Would you please share a little more information?

- what platform you running it on?

- how much space you allocated for logs?

- how frequently do you logswitch?

- what do you do with the data?

- it's says $295 price? Is it really free? Which one are you using?

Your reply is really appreciated.

Val

Re: Recommend a syslog server for PA Firewall

lewis — Tue, 16 Jun 2015 13:03:23 GMT

Running on Server 2012, 2TB, keep logs about 6 months, logs are recorded in hour increments, compress them to keep a smaller finger print, version 9.3.3, dont remember the cost but it was a small amount