topic Re: PAN System Based Reports in General Topics

PAN System Based Reports

Retired Member — Wed, 20 Jun 2018 11:47:06 GMT

Hi,

I have question about some system reports requests. Can PAN firewalls provide config reports belonging to changes which users made? Also Can I get system resources report by historical?

Thanks

Re: PAN System Based Reports

kiwi — Wed, 20 Jun 2018 12:14:35 GMT

Hi @Retired Member,

The Configuration log should be able to provide you with config reports belonging to changes which users made. (Monitor tab > Logs > Configuration).

As for historical data on system resources ... SNMP can help you with that. This is just one of many links on SNMP : https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/monitor-statistics-using-snmp#34694

Or maybe even the browser extension Pan(w)achrome can help you : https://www.youtube.com/watch?v=gRP1MF76Aw0

Cheers !

-Kiwi.

Re: PAN System Based Reports

Retired Member — Wed, 20 Jun 2018 12:31:18 GMT

Hi @kiwi

Thanks for your information. Actualy I haven't known about chrome extension, It can be useful for me.

Also I need configuration report as pdf. Is there any way to obtain over PAN? Or how can I provide this?

Re: PAN System Based Reports

kiwi — Wed, 20 Jun 2018 12:42:39 GMT

Hi @Retired Member,

I believe you can email the config log as a PDF (Device tab > Log Settings > Configuration > Add > Email).

I hope this helps !

Cheers !

-Kiwi.

Re: PAN System Based Reports

Retired Member — Wed, 20 Jun 2018 13:25:06 GMT

Hi @kiwi

I will experiement your mentioned.

Thanks for your all support

Re: PAN System Based Reports

BPry — Wed, 20 Jun 2018 18:08:27 GMT

@Retired Member,

I'm not sure that the logs setings that @kiwi menitoned will show up as a PDF. However if you configure an alert like so

          <entry name="config-any">
            <send-email>
              <member>Alert-Brandon</member>
            </send-email>
            <send-snmptrap>
              <member>Solar-SNMP</member>
            </send-snmptrap>
            <send-syslog>
              <member>Splunk</member>
            </send-syslog>
            <filter>All Logs</filter>
          </entry>

You'll get alerts emailed to you that look like this

domain: 1
receive_time: 2018/06/19 22:00:05
serial: 
seqno: 6561945734562709763
actionflags: 0x0
type: CONFIG
subtype: 0
config_ver: 0
time_generated: 2018/06/19 22:00:05
dg_hier_level_1: 0
dg_hier_level_2: 0
dg_hier_level_3: 0
dg_hier_level_4: 0
vsys_name: 
device_name: LegFPA
vsys_id: 0
host: 10.191.16.61
vsys: 
cmd: commit
admin: XML-API
client: CLI
result: Submitted
path: 
detail:

And any change an admin makes would look like this:

domain: 1
receive_time: 2018/06/20 13:07:05
serial: 
seqno: 6561945734562709787
actionflags: 0x0
type: CONFIG
subtype: 0
config_ver: 0
time_generated: 2018/06/20 13:07:05
dg_hier_level_1: 0
dg_hier_level_2: 0
dg_hier_level_3: 0
dg_hier_level_4: 0
vsys_name: 
device_name: LegFPA1
vsys_id: 0
host: 10.191.16.61
vsys: 
cmd: edit
admin: bpry
client: CLI
result: Succeeded
path: vsys vsys1 address 10.191.133.5
detail: <change><before><![CDATA[10.191.133.5 { } ]]></before><after><![CDATA[H-10.191.133.5 { tag [ Server ]; } ]]></after></change>