collecting palo alto firewall logs with Graylog 2.5

[Ayoub2]

Dear palo alto community,

I collect the palo alto firewall logs with Graylog 2.5.

When i make an ssh connection to the fw palo alto with an incorrect password, this ssh connection does not get into the logs on Graylog interface web why ? To configure the syslog profile I followed this link

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFfCAK

Thanks. 

[ebonjour]

Just tested my setup and was able to see failed SSH attempts.

What version of PAN-OS are you running?  I'm on 8.0, has been working since 7.0.

I don't have a log forwarder setup for my syslog profile at all and I only receieve System messages.  Try deleting your log forwarder.

[ebonjour]

Found out why I don't have a log forwarder for syslog, its not the right place for system messages!

In Device -> Log Settings, you should see at the top System.  You need to configure the system-"level" alerts to output to your syslog profile.

[OtakarKlier]

Hello,

Also check you log profile settings to make sure its getting sent to the syslog server.

Regards,

[Ayoub2]

thanks for your reply, pan os palo 8.0.9

[Ayoub2]

I Create a syslog server profile in FW palo and I configured it, I received the logs as examples of rules configured under the firewall

---

@Ayoub2 wrote:

thanks for your reply, pan os palo 8.0.9

---

[Ayoub2]

Please, I want to know exactly, how I configure my syslog profile on the palo alto firewall, to have logs ssh login attempts failed on the web interface of my log management "Graylog"

[OtakarKlier]

Hello,

Make sure all the filter options are set to syslog.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTrCAK

Regards,

[Ayoub2]

Hello,

Thank you for your attention to this matter. I'll check.

Best regards,

Ayoub Labidi 

[Ayoub2]

Hello,  

I’m sorry for bothering you ,the problem still persists, I can't receive the logs of ssh failed from FW palo, I get except the rules logs.

Best regards,

Ayoub Labidi