topic Re: Threat,virus Log in General Topics

Threat,virus Log

NHorsch — Mon, 11 Nov 2013 15:07:11 GMT

Oct 27 23:00:32 10.208.35.87 Oct 27 22:57:23 PA-VM 1,2013/10/27 22:57:22,007000001148,THREAT,virus,1,2013/10/27 22:57:22,192.168.1.73,192.168.2.71,0.0.0.0,0.0.0.0,Test,,,ftp,vsys1,Trust,Untrust,ethernet1/1,ethernet1/2,Log Forwarding,2013/10/27 22:57:22,9906,1,49497,53510,0,0,0x80000000,tcp,deny,"eicar.com",100000(100000),any,medium,server-to-client,0,0x0,192.168.0.0-192.168.255.255,192.168.0.0-192.168.255.255,0,,1199317001038725136,,,

i have seen on extra field added in the default syslog format of the threat log ..marked as red as you can see above....what is the name of the field and its significance?

I didn't find the updated syslog integration document on the palo alto website....can you people please update the same.

Re: Threat,virus Log

kadak — Mon, 11 Nov 2013 16:18:06 GMT

Hello NHorsch,

That number (1199317001038725136.....) would be the sequence number which is a 64bit log entry identifier that increments sequentially. Each log type has a unique number space.

Thanks and regards,

Kunal Adak

Re: Threat,virus Log

NHorsch — Tue, 12 Nov 2013 05:04:32 GMT

Thanks kadak for replying...

I have a doubt.....

But it does not appear in every log line....it is in only THREAT,virus log line.....

If its an incremental number then it should also present in other logs too.

Re: Threat,virus Log

mikand — Sun, 01 Dec 2013 16:52:25 GMT

In which PANOS did this show up and why isnt the syslog integration document updated with this field if its wellknown within PA?