topic Re: Collect syslog information in General Topics

Collect syslog information

BigPalo — Fri, 17 May 2019 08:33:20 GMT

Hi,

We are going to add a new syslog server in PA config. So we would like to do a bit audit about PA supporting syslog sessions.

What si the best way to know:

-Volume of traffic per day for syslog

-Top10 destination syslogs

-.....

thanks.

Re: Collect syslog information

OtakarKlier — Fri, 17 May 2019 15:59:40 GMT

Hello,

As for syslogs per day. That depends on your environment. Like for us, its in the 10's of millions. I would work with your SIEM vendor and get a demo license first and see what the ingest rate is of all the logs you wish to capture. At that point you can determine what the actual scale would be.

Hope that helps.

Re: Collect syslog information

Remo — Fri, 17 May 2019 19:59:24 GMT

Hi @BigPalo

This article will probably help in your situation. It is actually written for panorama sozing but the steps you need to take for a proper panorama sizing can be applied also to a syslog server: https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/set-up-panorama/determine-panorama-log-storage-requirements.html

Re: Collect syslog information

BPry — Fri, 17 May 2019 21:20:57 GMT

@BigPalo,

Agree with @OtakarKlier, the vast majority of SIEMs will be happy to supply you with an unlimited trial license for a few weeks so you can configure it exactly how you want and have legitimate numbers for how many logs you'll actually pass. Just be mindful of the pricing model of the SIEM when you are deciding what you actually want to send to it and if it'll actually be useful. When you get to something like Splunk pricing alone can determine what you are actually passing off of the box.