topic How to forward DHCP logs to syslog server (SIEM) in General Topics

How to forward DHCP logs to syslog server (SIEM)

Chris_Parsons — Wed, 06 Jan 2016 13:32:19 GMT

Does anyone know how to set up forwarding of DHCP logs (leases being issued mainly) from a PAN device operating a DHCP server to a SIEM via syslog? I've already configured a log forwarding profile but I'm not seeing the appropriate DHCP lease logs in my SIEM.

Re: How to forward DHCP logs to syslog server (SIEM)

glastra1 — Wed, 06 Jan 2016 14:28:02 GMT

Are you sending the system logs to the syslog server?

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Forward-System-Logs-to-Syslog-Server/ta-p/61804

Are receiving other logs than the DHCP ones?

Regards,

Gerardo.

Re: How to forward DHCP logs to syslog server (SIEM)

ReimoS — Mon, 29 May 2023 13:47:30 GMT

Hello

I also need help with the same issue, how can i forward DHCP lease info to SEIM/syslog server

Re: How to forward DHCP logs to syslog server (SIEM)

aleksandar.astardzhiev — Mon, 29 May 2023 19:39:08 GMT

Hi @ReimoS ,

DHCP lease logs are subtype of system logs. To forward system logs to syslog you need:

1. Create syslog server profile for your SIEM collector

2. Config firewall to forward system logs to syslog by Device -> Log Settings -> System Logs

3. Optionally you can configure log filter to forward only DHCP related logs.