10-28-2015 07:15 AM
Is it possible to send the syslogs for only the system changes from the pa to solarwinds? How to you configure the PA to send the change logs to solarwinds?
11-09-2015 12:46 PM
So are you saying if I set up a syslog server for solarwinds and go to device\logging setting\config and add it there it will only send config changes and system logs to the solarwinds server? I have snmp traps on that location too but it can probably be replaced with the syslog server
11-09-2015 12:55 PM
That just sets up the PAN to send config changes, you would also need to go to Device->LogSettings->System and configure which type of system logs you would like to send.
Neither of the above settings are for the traffic or threat logs.
11-09-2015 01:23 PM
By type you mean informationanl critical, high etc
11-09-2015 02:13 PM
For the system logs, correct. Config logs is all or none. Makes sense that way, to me at least.
11-10-2015 05:47 AM
Right now I have snmp traps enabled by going to device\server profiles\snmp traps. I went to device\log settings\system and configured snmp traps for the high and critca alerts then I added the snmp trap profile to device\log settings\config
My other option is to go to the device\server profiles\syslog and create a syslog server profile and then add it to to device\log settings\config. In this option I don't see a way to pick and choose what information goes to the solarwinds server. It looks like to me that all the traffic, threat logs everything goes to the solar wind server.
To me it looks like the syslogs server sends far more informaiton than the snmp traps does but it also sends much more than system and configuration changes.
11-10-2015 03:29 PM
Correct, I have seen that same result with other products as well. The Syslog does send more data/informtaion than the snmp traps.
11-11-2015 08:22 AM
I went ahead and just setup the syslog server and put it on the device\log setting\config and removed the snmp traps from that same location. I think thats about all I can do the rest of the configuration needs to be completed on the solarwinds side from what I can tell
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
