Dear palo alto community,
I collect the palo alto firewall logs with Graylog 2.5.
When i make an ssh connection to the fw palo alto with an incorrect password, this ssh connection does not get into the logs on Graylog interface web why ? To configure the syslog profile I followed this link
Just tested my setup and was able to see failed SSH attempts.
What version of PAN-OS are you running? I'm on 8.0, has been working since 7.0.
I don't have a log forwarder setup for my syslog profile at all and I only receieve System messages. Try deleting your log forwarder.
Found out why I don't have a log forwarder for syslog, its not the right place for system messages!
In Device -> Log Settings, you should see at the top System. You need to configure the system-"level" alerts to output to your syslog profile.
I Create a syslog server profile in FW palo and I configured it, I received the logs as examples of rules configured under the firewall
thanks for your reply, pan os palo 8.0.9
Please, I want to know exactly, how I configure my syslog profile on the palo alto firewall, to have logs ssh login attempts failed on the web interface of my log management "Graylog"
Make sure all the filter options are set to syslog.
I’m sorry for bothering you ,the problem still persists, I can't receive the logs of ssh failed from FW palo, I get except the rules logs.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!