Way to forward logs from individual rules instead of entire firewall?

[BOkay]

Is there a way to forward logs from individual rules by adding Expedition to their Log Forwarding Profile rather than setting up a Scheduled Log Export which forwards an entire firewall's logs?

Reason I ask is I need to use MI to analyze traffic for some specific rules but do not need to analyze traffic on an entire firewall. I have Scheduled Log Export setup for some smaller firewalls where the entire policy needs to be analyzed and this works well.  But, I also have some very large high traffic firewalls where I need to analyze only a few rules and scheduling the export of their entire traffic log would just be too much for our Expedition server.  

Any thoughts?  Thank you!

[lychiang]

Hi @BOkay 

This question will be a PAN-OS question, I know there is an "scp export traffic log" command that you can specify the filter using "query", you might want to open a case with TAC and ask them if there is a way to export only traffic logs matching specific rule name.  

[dgildelaig]

Hi,

Yes, this is possible using Expedition as a Syslog server and using a Log Forwarding profile as you stated.

To make sure that Expedition is receiving the traffic logs using syslog messages, check this other thread where we mentioned how to set up these parts.

https://live.paloaltonetworks.com/t5/expedition-discussions/expedition-as-syslog-server-change-logs-...