topic Re: collecting palo alto firewall logs with Graylog 2.5 in General Topics

collecting palo alto firewall logs with Graylog 2.5

Ayoub2 — Mon, 13 May 2019 21:15:14 GMT

Dear palo alto community,

I collect the palo alto firewall logs with Graylog 2.5.

When i make an ssh connection to the fw palo alto with an incorrect password, this ssh connection does not get into the logs on Graylog interface web why ? To configure the syslog profile I followed this link

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFfCAK

Thanks.

Re: collecting palo alto firewall logs with Graylog 2.5

ebonjour — Mon, 13 May 2019 21:41:14 GMT

Just tested my setup and was able to see failed SSH attempts.

What version of PAN-OS are you running? I'm on 8.0, has been working since 7.0.

I don't have a log forwarder setup for my syslog profile at all and I only receieve System messages. Try deleting your log forwarder.

Re: collecting palo alto firewall logs with Graylog 2.5

ebonjour — Mon, 13 May 2019 21:50:27 GMT

Found out why I don't have a log forwarder for syslog, its not the right place for system messages!

In Device -> Log Settings, you should see at the top System. You need to configure the system-"level" alerts to output to your syslog profile.

Re: collecting palo alto firewall logs with Graylog 2.5

OtakarKlier — Mon, 13 May 2019 21:50:34 GMT

Hello,

Also check you log profile settings to make sure its getting sent to the syslog server.

Regards,

Re: collecting palo alto firewall logs with Graylog 2.5

Ayoub2 — Mon, 13 May 2019 22:10:53 GMT

thanks for your reply, pan os palo 8.0.9

Re: collecting palo alto firewall logs with Graylog 2.5

Ayoub2 — Mon, 13 May 2019 22:16:06 GMT

I Create a syslog server profile in FW palo and I configured it, I received the logs as examples of rules configured under the firewall

@Ayoub2 wrote:
thanks for your reply, pan os palo 8.0.9

Re: collecting palo alto firewall logs with Graylog 2.5

Ayoub2 — Mon, 13 May 2019 22:19:04 GMT

Please, I want to know exactly, how I configure my syslog profile on the palo alto firewall, to have logs ssh login attempts failed on the web interface of my log management "Graylog"

Re: collecting palo alto firewall logs with Graylog 2.5

OtakarKlier — Tue, 14 May 2019 13:45:53 GMT

Hello,

Make sure all the filter options are set to syslog.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTrCAK

Regards,

Re: collecting palo alto firewall logs with Graylog 2.5

Ayoub2 — Tue, 14 May 2019 16:03:10 GMT

Hello,

Thank you for your attention to this matter. I'll check.

Best regards,

Ayoub Labidi

Re: collecting palo alto firewall logs with Graylog 2.5

Ayoub2 — Wed, 15 May 2019 10:35:34 GMT

Hello,

I’m sorry for bothering you ,the problem still persists, I can't receive the logs of ssh failed from FW palo, I get except the rules logs.

Best regards,

Ayoub Labidi