topic Logging Discarded Traffic in General Topics

Logging Discarded Traffic

Nico-UBX — Wed, 08 Apr 2020 15:50:20 GMT

Hello,

I had recently had an issue where I had to move a syslog server behind a cluster of PA-5250.

This syslog server receives logs from different equipements (~ 100GBytes per day) so there is an enormous amount of udp syslog events received by this server.

When the server was behind this cluster, I was not receiving any logs. After some troubleshooting, I found out that the flow was in the "DISCARDED" state in CLI, but there was not any logs that did capture this event. Moreover I did some packet capture and these flows did not appear in the "receiving" state !

I cleared this flow and put an Dos protection rule to permit this type of traffic, but is there a way to log when trafic is in DISCARDED state ? That would help me during future troubleshooting sessions.

Thank you.

Regards,

Re: Logging Discarded Traffic

BPry — Wed, 08 Apr 2020 17:48:13 GMT

@Nico-UBX,

I don't believe this is anything that is built-in at the moment. You would need to utilize the API to actively pull what sessions are in a discarded state and log them separately and do any alerting you may want to.

Re: Logging Discarded Traffic

Nico-UBX — Thu, 09 Apr 2020 10:22:22 GMT

Thank you for your answer. I was hoping that this was possible, but well I will do with that.