Link Failure - Syslog

[MPI-AE]

Hey all!

I have a PA-3020, eth1/1 and eth1/2 are an aggregate (ae1).

on the switch, it's a Port-channel.

I want to be informed when one of both interfaces is down.

So I set up a syslog server and all system logs are forwarded.

For testing purposes, I shut down one port on the switch.

eth1/1 is down now.

But in the system log, I just get "informational - link-change - Port eth1/1:Down"

I don't like the severity "informational".

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/monitoring/log-types-and-severity-le...

tells me link failures have a severity of "critical", but not in my case.

What can I do?

Respectively, how do you monitor the status of your (aggregate) interfaces?

Thanks!

[kiwi]

Hi @MPI-AE,

Manually setting the port down is a configuration change.  It's normal those events are 'informational'.

It's different if you pull the cable for example.

That said, you can't change severity.

Starting from PAN-OS 8.0 you can filter log-forwarding.

Cheers !

-Kiwi.

---EDIT--- 😄

I noticed now you configure it on the switch XD

So, on the firewall this means your aggregate isn't completely down >> informational.

Filtering log-forwarding would still be an option.

Cheers !

-Kiwi