Expedition as syslog server, change logs directory

[LukeBullimore]

Hi Team!

We wish to use the Expedition tool for some logs coming from a PA-7000 series. Since the scheduled log export option is not feasible we wish to export logs via syslog. A few questions with this.

1. Where is the default location that the syslogs will go to?

2. Can we change the default log location, if so how? (We will be adding new virtual disk mounted to /PALogs and want to make the logs go there)

3. What will the permissions need to be on the new logs folder, does it need to be owned by "syslog" or "expedition", both? How?

I have a funny feeling its to do with the rsyslog.confg file but could do with some assistance.

Cheers,

Luke.

[dgildelaig]

For anyone reading this thread in the future, we have found that in some cases, to see logs getting into the desired folder, it is ALSO necessary to restart the VM. Restarting the service did not seem to be enough, and as I am not a guru to identify which other services are involved in this process, what we found out is that restarting the VM helped to start seeing the logs arriving into the desired folder.

We spent hours with a client to see whether the config was wrong (which look perfect), sniffing traffic to see that was hitting the Expedition VM from the Firewalls that were forwarding the syslog entries, and at the end, we just reboot the VM and voilá!

I hope this helps others.

[hamadahFarajallah]

Hi,

I have face same issue, how can automatically parse these file i can not see it in the expedition GUI, when you go to devices --> m.Lerning noting is there?

any thing that i need to be done?

thanks in advance

Hamadah 

[hamadahFarajallah]

Hi,

I have an issue i can see the csv file in the folder but how can automatically parse these file,  I can not see it in the expedition GUI, when you go to devices --> m.Lerning noting is there?

any thing that i need to be done?

thanks in advance

Hamadah 

[lychiang]

@hamadahFarajallah Please make sure your expedition is up to date on v 1.1.105 since there was a fixed for the issue you running to in the earlier version.  

[azuniga]

Hello,

We had an issue on 1.1.104 with machine learning so we pushed a fix out on 1.1.105 so if you are currently using that version I would suggest you upgrade to the latest. If this isn't the case just make sure that the folder permissions are there for the PALogs folder and the sub folder within PALogs.