PA firewall is not forwarding logs to Splunk indexer

Sandeep_R — Wed, 21 Nov 2018 05:52:40 GMT

Hi Dears,

I have a issue regarding the log forwarding.

Paloalto logs are forwarded to splunk SIEM in our environment. We were running panos 8.0.10 and the log forwarding was working as expected. Recently we upgraded to version 8.0.12 which is a TAC recommended version. Since upgrade PA appliance is not forwarding the logs in real time. Instead, it is forwarding the logs in bulk 2 or 3 times a day.

DR firewall is sending the logs to Splunk indexer.

We tested adding a test syslog server to PA device, it is working as expected.

Intresting thing is, the other PA firewalls in the network with similar logging configuration are sending logs as expected.

Kindly suggest me how the issue can be identified and troubleshooted.

Regards,

Sandeep

Re: PA firewall is not forwarding logs to Splunk indexer

BPry — Wed, 21 Nov 2018 17:50:21 GMT

@Sandeep_R,

Have you tried restarting the firewall in question or simply restarting the log-receiver process?

topic Re: PA firewall is not forwarding logs to Splunk indexer in General Topics

PA firewall is not forwarding logs to Splunk indexer

Re: PA firewall is not forwarding logs to Splunk indexer