Link down between Firewall and Syslog server

Tutchapon — Fri, 06 Nov 2020 08:19:03 GMT

Hi all,

I'm looking for any KB or official document that explain the log forwading behavior when link between FW and Syslog server is down.

As I understood that PA firewall will not resend the the log at the moment of link between them is down to sylog server once the link is back.

Re: Link down between Firewall and Syslog server

S.Cantwell — Fri, 06 Nov 2020 11:12:30 GMT

The only log storing that I am aware of, is when FW to Panorama link is lost... then the FW will buffers its logs, to send to Panorama.

This functionality is not available with Syslog, and I do not believe there is a document to explain it.

With syslog, the FW send the messages outbound.... if there is no connectivity, the FW is not aware of this, and continues to forward to a location of the network that does not exist. It is basic OSI model troubleshooting. If L1 is down, nothing will egress.

topic Link down between Firewall and Syslog server in General Topics

Link down between Firewall and Syslog server

Re: Link down between Firewall and Syslog server