Content / Database Versions Do Not Match

[xcz504d1114]

Every week I recieve these emails while the PAN firewalls do their weekly updates, is there a way to not recieve these e-mails, the time stamps are exactly the same from each device, as they are upgrading at the exact same time. Is there a setting in Panorama that can eliminate these needless messages?

Thanks,

Craig

[rmonvon]

Hi...You can instruct the PAN firewalls not to forward system logs to Panorama, and/or don't forward system logs to email.  The system logs are assigned different severity level and you can select the level(s) you want to send.

Thanks.

[xcz504d1114]

Thanks for the response. The e-mail notifications that are being sent are categorized as "High", obviously I would want to know of severity levels of High and Critical, or am I missing a way to filter out certain messages, as opposed to just severity? I pasted an example of one of the e-mails I recieve during the weekly updates, so that I am accurately describing  the situation.

I recieve one of these emails for each firewall, and each content type (application, url, threat prevention) during weekly updates.

domain: 1
receive_time: 2012/03/14 01:08:18
serial: XXXXXXXXXXXXXX

seqno: 0
actionflags: 0x0
type: SYSTEM
subtype: ha
config_ver: 0
time_generated: 2012/03/14 01:08:18
vsys:
eventid: peer-version-match
object:
fmt: 0
id: 0
module: general
severity: high
opaque: HA Group 1: Application Content version does not match

Thanks again,

Craig

[rmonvon · Accepted solution]

We can filter on the log messages(descriptions) while viewing the logs but not for forwarding.  We can only filter on log severity level and forward/not forward by severity.

You would have to filter externally via a SEIM tool or use rule wizard (rules and alerts) in Outlook to delete those unwanted events.  Thanks.

[xcz504d1114]

Thank you very much! I appreciate your response!