Link Failure - Syslog

MPI-AE — Thu, 18 May 2017 06:40:12 GMT

Hey all!

I have a PA-3020, eth1/1 and eth1/2 are an aggregate (ae1).

on the switch, it's a Port-channel.

I want to be informed when one of both interfaces is down.

So I set up a syslog server and all system logs are forwarded.

For testing purposes, I shut down one port on the switch.

eth1/1 is down now.

But in the system log, I just get "informational - link-change - Port eth1/1:Down"

I don't like the severity "informational".

tells me link failures have a severity of "critical", but not in my case.

What can I do?

Respectively, how do you monitor the status of your (aggregate) interfaces?

Thanks!

Re: Link Failure - Syslog

kiwi — Thu, 18 May 2017 08:05:21 GMT

Manually setting the port down is a configuration change. It's normal those events are 'informational'.

It's different if you pull the cable for example.

That said, you can't change severity.

Starting from PAN-OS 8.0 you can filter log-forwarding.

Cheers !

-Kiwi.

---EDIT--- 😄

I noticed now you configure it on the switch XD

So, on the firewall this means your aggregate isn't completely down >> informational.

Filtering log-forwarding would still be an option.

Cheers !

-Kiwi