topic Re: ant to check logging rate and disk-utilization used in M200 for log types in General Topics

ant to check logging rate and disk-utilization used in M200 for log types

Deepak25 — Fri, 13 Aug 2021 19:52:30 GMT

We have configured collector group config with local log collector. All firewall's forwarding logs to collector, we can see log incoming rate in panorama for traffic , threat . But for URL , Wildfire and other types of logs logging rate is not showing. Also want to check disk-utilized by each logs type in collector. As we can see overall details and summary log quota. But no disk-utilization showing for individual log types. Also in firewall log forwarding status logging rate is not showing for url , wildfire and other types of logs.

URL-filtering , Wildfire-logs and data-filtering logs coming under which log types ? can we count this under traffic logs ?
If we want to forward only URL-filtering logs to Panorama , log forwarding of traffic logs is necessary ?

Panorama :

(primary-active)> debug log-collector log-collection-stats show incoming-logs

Firewall :

Re: ant to check logging rate and disk-utilization used in M200 for log types

batd2 — Mon, 16 Aug 2021 09:44:18 GMT

@Deepak25 URL Filtering, File, Data and Wildfire are all subtypes of the Threat logs, not the Traffic Logs. Each of theses is sent in the threat logs with the relevant "Threat/Content Type (subtype)" field, e.g. "data", "wildfire", "url".

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields.html

Answering your second question, you can be very granular in choosing which logs are forwarded external and you can indeed forward particular subtype (for example URL filtering logs) to a log collector, without needing to forward all traffic logs.

Re: ant to check logging rate and disk-utilization used in M200 for log types

Deepak25 — Mon, 16 Aug 2021 10:27:54 GMT

@batd2 Just want to reconfirm.

As you said url-filtering is coming under threat logs in detailed log types.

So if I want to forward only url-filtering logs , log forwarding of threat logs is not required. Is it correct ?

Re: ant to check logging rate and disk-utilization used in M200 for log types

batd2 — Tue, 17 Aug 2021 10:46:36 GMT

@Deepak25 Yes, you can configure only url log forwarding.

It is a little bit confusing, as mentioned previous data, url, spyware, etc. are all subtypes of the Threat syslog. However when building your log forwarding profile object (Objects>Log Forwarding), threat has a different meaning. Threat will cover any threat subtype, which does not have specific log type selector, e.g. spyware, virus, vulnerability. URL, data and wildfire logs will not be sent if you configure only log type "threat".