collecting palo alto firewall logs with Graylog 2.5

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

collecting palo alto firewall logs with Graylog 2.5

L1 Bithead

Dear palo alto community,

 

I collect the palo alto firewall logs with Graylog 2.5.

When i make an ssh connection to the fw palo alto with an incorrect password, this ssh connection does not get into the logs on Graylog interface web why ? To configure the syslog profile I followed this link

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFfCAK

 

Thanks. 

 

 

9 REPLIES 9

L2 Linker

Just tested my setup and was able to see failed SSH attempts.

What version of PAN-OS are you running?  I'm on 8.0, has been working since 7.0.

 

I don't have a log forwarder setup for my syslog profile at all and I only receieve System messages.  Try deleting your log forwarder.

 

Found out why I don't have a log forwarder for syslog, its not the right place for system messages!

 

In Device -> Log Settings, you should see at the top System.  You need to configure the system-"level" alerts to output to your syslog profile.

Hello,

Also check you log profile settings to make sure its getting sent to the syslog server.

Regards,

thanks for your reply, pan os palo 8.0.9

I Create a syslog server profile in FW palo and I configured it, I received the logs as examples of rules configured under the firewall


@Ayoub2 wrote:

thanks for your reply, pan os palo 8.0.9




Please, I want to know exactly, how I configure my syslog profile on the palo alto firewall, to have logs ssh login attempts failed on the web interface of my log management "Graylog"

Hello,

Make sure all the filter options are set to syslog.

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTrCAK

 

Regards,

Hello,

Thank you for your attention to this matter. I'll check.

 

Best regards,

Ayoub Labidi 

Hello,  

I’m sorry for bothering you ,the problem still persists, I can't receive the logs of ssh failed from FW palo, I get except the rules logs.

 

Best regards,

Ayoub Labidi 

  • 7624 Views
  • 9 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!