syslog from PAM OS 3.1 to 4.1

helenio.sartori — Fri, 28 Sep 2012 14:36:24 GMT

Hi,

I migrated our PAN FW from 3.1 to 4.1 and there is some more fields on TRAFFIC and THREAT syslog format.

With 3.1, using syslog-ng, I got:

Sep 27 00:00:35 giacometti-2 00: 00:35,0003C100873,TRAFFIC,end, etc ...

Since by defualt in 4.1 there is more field than with 3.1 I'd like to customize the syslog format in a way that have the sames format as it was on 3.1 (to avoind, for the moment to change syslog parser tool):

$serial,$type,$subtype,$padding,$time_generated,$src,$dst,$natsrc,$natdst,$rule,$srcuser,$dstuser,$app,$vsys,$from,$to,$inbound_if,$outbound_if,$logset,$padding,$sessionid,$repeatcnt,$sport,$dport,$natsport,$natdport,$flags,$proto,$action,$bytes,$bytes_sent,$bytes_received,$packets,$start,$elapsed,$category,$padding

And with this format i get:

Sep 28 16:29:16 giacometti-test 16: 29:15,10.44.39.26,199.47.219.159,0.0.0.0,0.0.0.0,AC Standard,ac\t128636,,ssl,vsys1,AC-Trust,AC-Untrust,ethernet1/3,ethernet1/4,Netlog-AC,0,136120,1,4310,443,0,0,0x0,tcp,allow,354,288,66,4,2012/09/28 16:29:15,0,any,0

As you can see the firs 4 fields ($serial,$type,$subtype,$padding) are dropped somewhere, does someone have an idea why ?

Re: syslog from PAM OS 3.1 to 4.1

msullivan — Fri, 28 Sep 2012 16:59:54 GMT

Hi,

Checkout device->server profiles->syslog

Create a profile and then customize it via the custom log format tab.

Cheers,

Mike

topic syslog from PAM OS 3.1 to 4.1 in General Topics

syslog from PAM OS 3.1 to 4.1

Re: syslog from PAM OS 3.1 to 4.1