Collect Separate CEF log files on the Syslog server for the log rotate

[shoebece]

We have configured the syslog server to send PA logs to Azure Sentinel, everything works fine but on the syslog server palo alto appending logs on a single file and that's becoming huge. We need a separate log files to be created by date vise so we can do log rotate on the syslog server to avoid disk to get full.

[OtakarKlier · Accepted solution]

Hello,

This setting should be on the SIEM. This is how we have ours set. Not sure about Azure Sentinel however.

Regards,