08-24-2015 05:02 AM - edited 09-01-2015 01:48 AM
we're shipping our logs to a centralized syslog instance. That works great for all types of logs from the PA with the exceptions of the CONFIG logs.
The CONFIG logs are submitted at all, with the problem that the interesting parts "before-change-detail" and "after-change-detail" are not delivered.
Does anyone else ship CONFIG logs and if yes, do you see the same behaviour?
Thanks for advice.
Submitted Syslog Message
2015-02-02 10:32:59 User.Info 220.127.116.11 Feb 2 10:32:59 paloalto.domain.com 1,2015/02/02 10:32:59,123444,CONFIG,0,0,2015/02/02 10:32:59,18.104.22.168,,edit,admin-name,Web,Succeeded, vsys vsys1 rulebase security rules one-rule-to-rule-them-all,1544,0x0
Expected Syslog Message
2015-02-02 10:32:59 User.Info 22.214.171.124 Feb 2 10:32:59 paloalto.domain.com 1,2015/02/02 10:32:59,123444,CONFIG,0,0,2015/02/02 10:32:59,126.96.36.199,,edit,admin-name,Web,Succeeded, vsys vsys1 rulebase security rules one-rule-to-rule-them-all,before-change-detail,after-change-detail,1544,0x0
08-24-2015 05:18 AM
08-24-2015 05:58 AM - edited 08-24-2015 06:22 AM
we're running PAN-OS 6.1.5. Logshipping is done via UDP; we've tried TCP with no difference in the result.
CONFIG logs are successful submitted, but a portion of the content is missing; see my sample snippets.
When you export Montior > Configuration to a csv file you have two fields called "before-change-detail" and "after-change-detail". Those two fields are missing in the syslog stream.
Update 1: Just did a tcpdump as suggested. Data is sent, but without those two fields in question.
08-27-2015 03:08 PM
sorry for quick reading. I would say that is expected behavior, per documentation found here:
FUTURE_USE, Receive Time, Serial Number, Type, Subtype, FUTURE_USE, FUTURE_USE, Host, Virtual
System, Command, Admin, Client, Result, Configuration Path, Sequence Number, Action Flags
full description on page 14
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!