Palo Alto logs to Cloudwatch logs possible?

L0 Member

Palo Alto logs to Cloudwatch logs possible?

I'm looking to see if we're able to push Palo Alto VM's syslogs and traffic logs to AWS CloudWatch logs.


Just to be clear, I'm not looking to monitor Palo Alto metrics using CloudWatch but need to push logs from the firewall to CloudWatch logs.


Is this possible at all?



L7 Applicator

Re: Palo Alto logs to Cloudwatch logs possible?


Officially I don't think this is supported at all, as CloudWatch doesn't really expose an easy way to injest logs outside of an instance with the agent installed. That being said, you can rig CloudWatch to look at /var/log/messages and configure an EC2 instance to accept your syslog messages and pass them to that location to get them into CloudWatch. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!