collecting palo alto firewall logs with Graylog 2.5

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Reply
Ayoub2
L1 Bithead

collecting palo alto firewall logs with Graylog 2.5

Dear palo alto community,

 

I collect the palo alto firewall logs with Graylog 2.5.

When i make an ssh connection to the fw palo alto with an incorrect password, this ssh connection does not get into the logs on Graylog interface web why ? To configure the syslog profile I followed this link

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFfCAK

 

Thanks. 

 

 

ebonjour
L2 Linker

Just tested my setup and was able to see failed SSH attempts.

What version of PAN-OS are you running?  I'm on 8.0, has been working since 7.0.

 

I don't have a log forwarder setup for my syslog profile at all and I only receieve System messages.  Try deleting your log forwarder.

 

ebonjour
L2 Linker

Found out why I don't have a log forwarder for syslog, its not the right place for system messages!

 

In Device -> Log Settings, you should see at the top System.  You need to configure the system-"level" alerts to output to your syslog profile.

OtakarKlier
Cyber Elite

Hello,

Also check you log profile settings to make sure its getting sent to the syslog server.

Regards,

Ayoub2
L1 Bithead

thanks for your reply, pan os palo 8.0.9

Ayoub2
L1 Bithead

I Create a syslog server profile in FW palo and I configured it, I received the logs as examples of rules configured under the firewall


@Ayoub2 wrote:

thanks for your reply, pan os palo 8.0.9




Ayoub2
L1 Bithead

Please, I want to know exactly, how I configure my syslog profile on the palo alto firewall, to have logs ssh login attempts failed on the web interface of my log management "Graylog"

OtakarKlier
Cyber Elite

Hello,

Make sure all the filter options are set to syslog.

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTrCAK

 

Regards,

Ayoub2
L1 Bithead

Hello,

Thank you for your attention to this matter. I'll check.

 

Best regards,

Ayoub Labidi 

Ayoub2
L1 Bithead

Hello,  

I’m sorry for bothering you ,the problem still persists, I can't receive the logs of ssh failed from FW palo, I get except the rules logs.

 

Best regards,

Ayoub Labidi 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!