topic Re: Questions on logs export in General Topics

Questions on logs export

deshaw — Mon, 11 Mar 2013 13:06:07 GMT

Hello,

I am setting up Palo Alto Firewall and want to export logs in CSV format to a UNIX filer daily at a specified time of the day. I have these questions:

How do I schedule log export job so that it exports logs of only that particular day (and not all log history)?
What is the default size of the log buffer? If log buffer gets full before the scheduled export time, I want to export logs before they get overwritten. How to do this?

Also CSV files shows many columns, many of which are redundant. Where can I modify those columns?

Thanks.

Re: Questions on logs export

mikand — Mon, 11 Mar 2013 22:53:31 GMT

A workaround might be to use syslog from paloalto which outputs by default in csv format.

You can also in the custom log format define your own setup like if you dont like some columns.

Re: Questions on logs export

reaper — Tue, 12 Mar 2013 09:35:42 GMT

Hi!

In the device tab there is a section called "scheduled log export". this will allow you to set a scheduled daily event where the previous day's logs are exported in csv format and ftp'd/scp'd onto a server of your choice.

The only thing you'd need to verify is if your log volume allows you at least a full day's worth of logs, you can quickly check what the last log entry is to make sure there's enough headroom for the daily export to be successful

> show log traffic

regards

Tom

Re: Questions on logs export

_slv_ — Tue, 12 Mar 2013 10:35:20 GMT

Are you sure about ability to SCP logs to server?

I have 4.1.10 PAN and I see only FTP settings for export.

How to make scp?

regards

SLawek

Re: Questions on logs export

deshaw — Tue, 12 Mar 2013 11:03:52 GMT

we are running 5.0.2...

Re: Questions on logs export

reaper — Tue, 12 Mar 2013 11:54:26 GMT

the scp option became available in PANOS 5.0, in 4.1 you can only use ftp to transport the daily log export

regards

Tom