collecting palo alto firewall logs with Graylog 2.5

Reply
Highlighted
L1 Bithead

collecting palo alto firewall logs with Graylog 2.5

Dear palo alto community,

 

I collect the palo alto firewall logs with Graylog 2.5.

When i make an ssh connection to the fw palo alto with an incorrect password, this ssh connection does not get into the logs on Graylog interface web why ? To configure the syslog profile I followed this link

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFfCAK

 

Thanks. 

 

 

Highlighted
L2 Linker

Just tested my setup and was able to see failed SSH attempts.

What version of PAN-OS are you running?  I'm on 8.0, has been working since 7.0.

 

I don't have a log forwarder setup for my syslog profile at all and I only receieve System messages.  Try deleting your log forwarder.

 

Highlighted
L2 Linker

Found out why I don't have a log forwarder for syslog, its not the right place for system messages!

 

In Device -> Log Settings, you should see at the top System.  You need to configure the system-"level" alerts to output to your syslog profile.

Highlighted
Cyber Elite

Hello,

Also check you log profile settings to make sure its getting sent to the syslog server.

Regards,

Highlighted
L1 Bithead

thanks for your reply, pan os palo 8.0.9

Highlighted
L1 Bithead

I Create a syslog server profile in FW palo and I configured it, I received the logs as examples of rules configured under the firewall


@Ayoub2 wrote:

thanks for your reply, pan os palo 8.0.9




Highlighted
L1 Bithead

Please, I want to know exactly, how I configure my syslog profile on the palo alto firewall, to have logs ssh login attempts failed on the web interface of my log management "Graylog"

Highlighted
Cyber Elite

Hello,

Make sure all the filter options are set to syslog.

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTrCAK

 

Regards,

Highlighted
L1 Bithead

Hello,

Thank you for your attention to this matter. I'll check.

 

Best regards,

Ayoub Labidi 

L1 Bithead

Hello,  

I’m sorry for bothering you ,the problem still persists, I can't receive the logs of ssh failed from FW palo, I get except the rules logs.

 

Best regards,

Ayoub Labidi 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!