Syslog Issue.

Reply
Highlighted
L3 Networker

Syslog Issue.

Hi - I may have not understood how this is achieved - so apologies before I start!

I'm trying to forward logs for traffic and threat to syslog We have 2x 4050s and Panorama - all policy rules are added via panorama.

I've created a "log forwarding profile" in Panorama that says - forward all traffic and threats to panorama. This is then added to each rule on Panorma. Both the log forwarding profile and the addition to the individual rules are pushed to both the firewalls fine and I get logs on the Panorama.

However, I now want to set the traffic logs to forward to syslog as well. I go into Panorama and under the Panorama tab--->Server profiles-----> syslog.  I've created a syslog entry for my server. Still on Panorama I now go back to the "log forwardinng profile" I've already created and used and try and choose the syslog server I just created - it doesn't show on the drop down list.

NB - if I go onto the FW itself I can create a syslog server and then a log forwarding profile and choose the syslog server fine. I guess I could apply that to local rules for a full test - but I don't have any local rules only rule generated from Panorama (and of course the rules generated from Panorama can't be changed locally).

Am I missing something?

Thanks

Highlighted
L4 Transporter

Re: Syslog Issue.

Hi,

If you want to forward your log to syslog servers as well you need to forward it from the PA box. Panorama cannot forward the log to syslog server.

Jones

Highlighted
L3 Networker

Re: Syslog Issue.

Hi

Thanks for your reply. I can forward system and config logs fine from the PA boxes (both syslog and forward to panorama). What I can't do is syslog traffic rules (ie rule logging). I can't do this from the PA box itself and the rules were created on Panorama (so are not editable on the PA box). I can't see a way of doinng it - but it must be possible - rules created on Panorama - having them log to syslog. Please help!!

Highlighted
L4 Transporter

Re: Syslog Issue.

The log forwarding and syslog profiles will need to be created in Panorama and then referenced in the Panorama pre/post-rule. This way all elements of the forwarding mechanism are managed inside Panorama.

In 4.0 you are able to reference the Panorama pushed log forwarding profile in a local device rule if needed. This way any change to the Panorama forwarding profile affects both shared pre/post-rules as well as the device rule.

Highlighted
L3 Networker

Re: Syslog Issue.

Hi - thanks for your response. I understand what you're saying and it's what I have done. I've created the "log forwarder" and "syslog server" profiles in Panorama. However, the syslog server I've created in panorama doesn't display in the drop down list in the log forwarder I've created in Panorama. I can only use the syslog server I've created on Panorama for use in the "config" and "system" log settings - NOT the "log forwarder" - it just doesn't show up. I assume it's a bug?

L0 Member

Re: Syslog Issue.

It is a bug.

Once you've got the profile for the syslog server entered, do this from the CLI:

set panorama log-settings system critical send-syslog using-syslog-setting SYSLOG-PROFILE-NAME-GOES-HERE
set panorama log-settings system high send-syslog using-syslog-setting SYSLOG-PROFILE-NAME-GOES-HERE
set panorama log-settings system medium send-syslog using-syslog-setting SYSLOG-PROFILE-NAME-GOES-HERE
set panorama log-settings system low send-syslog using-syslog-setting SYSLOG-PROFILE-NAME-GOES-HERE
set panorama log-settings system informational send-syslog using-syslog-setting SYSLOG-PROFILE-NAME-GOES-HERE

Highlighted
L4 Transporter

Re: Syslog Issue.

I was not able to reproduce the problem.

What Panorama version are you running?

Highlighted
L0 Member

Re: Syslog Issue.

I think you need to reply to farrel.doherty.

I had the same problem with 4.0.3 which was confirmed by an onsite Palo Alto tech at the time.

The solution was to plug in the syslog target via the CLI.

Highlighted
L3 Networker

Re: Syslog Issue.

Thanks for all your replies! I'll try the CLI option today. We're currently running version 4.0.5 on both Panorama and the 4050s.

Highlighted
L3 Networker

Re: Syslog Issue.

Hi mstingley! Just realised that the CLI options you give aren't quite what I'm looking for. In 4.0.5 I can achieve what you needed to do in the CLI at 4.0.3. My issue is when editing the "Log Forwarding Profile" I can't reference the "syslog server profile" I've created. I can't see a way of doing this via the CLI either!

Anymore advice anyone?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!