Syslog Fields Mismatch the documentation PanOSV9.0

gnikesh — Wed, 22 May 2019 06:05:44 GMT

I have syslogs coming to my SIEM from the device with PanOS V9.0. The number of fields i am receiving and the number of fields specified in the documentation doesnot match.

For example, in TRAFFIC logs,

1,2019/05/09 15:09:20,xxxxxxxxxxxx,TRAFFIC,end,2304,2019/05/09 15:09:20,xx.xx.xx.xx,xx.xx.xx.xx,xx.xx.xx.xx,xx.xx.xx.xx,Allow all,,,ocsp,vsys1,Internal Wireless,Internet,ethernetxx,ethernetxx,SIEM,2019/05/09 15:09:20,18812,1,53613,80,40642,80,0x400000,tcp,allow,2322,769,1553,20,2019/05/09 15:02:41,279,computer-and-internet-info,0,192113874,0x0,xx.xx.xx.xx-xx.xx.xx.xx,xxxxx,0,6,14,aged-out,0,0,0,0,,XX-XX,from-policy,,,0,,0,,N/A,0,0,0,0,75a0f003-007b-4ae1-85f2-ede4fa21ea14,0

There are total 67 fields.

However, according to documentation, the fields should be:

FUTURE_USE, Receive Time, Serial Number, Type, Threat/Content Type, FUTURE_USE, Generated Time, Source Address, Destination Address, NAT Source IP, NAT Destination IP, Rule Name, Source User, Destination User, Application, Virtual System, Source Zone, Destination Zone, Inbound Interface, Outbound Interface, Log Action, FUTURE_USE, Session ID, Repeat Count, Source Port, Destination Port, NAT Source Port, NAT Destination Port, Flags, Protocol, Action, URL/Filename, Threat ID, Category, Severity, Direction, Sequence Number, Action Flags, Source Location, Destination Location, FUTURE_USE, Content Type, PCAP_ID, File Digest, Cloud, URL Index, User Agent, File Type, X-Forwarded-For, Referer, Sender, Subject, Recipient, Report ID, Device Group Hierarchy Level 1, Device Group Hierarchy Level 2, Device Group Hierarchy Level 3, Device Group Hierarchy Level 4, Virtual System Name, Device Name, FUTURE_USE, Source VM UUID, Destination VM UUID, HTTP Method, Tunnel ID/IMSI, Monitor Tag/IMEI, Parent Session ID, Parent Start Time, Tunnel Type, Threat Category, Content Version, FUTURE_USE, SCTP Association ID, Payload Protocol ID, HTTP Headers, UUID for rule

which is 66 fields.

I am getting an extra '0' field at the end. According to documentation, the log should end at UUID for rule, which has value 75a0f003-007b-4ae1-85f2-ede4fa21ea14.

Similarly, I am getting more fields in THREAT Logs.

Can anyone explain me what is causing this?

Re: Syslog Fields Mismatch the documentation PanOSV9.0

reaper — Wed, 22 May 2019 11:49:37 GMT

is the documentation perhaps for an older version of PAN-OS ?

topic Re: Syslog Fields Mismatch the documentation PanOSV9.0 in General Topics

Syslog Fields Mismatch the documentation PanOSV9.0

Re: Syslog Fields Mismatch the documentation PanOSV9.0

Re: Syslog Fields Mismatch the documentation PanOSV9.0