Custom Email alerts based on System logs in Panorama 8.x

[Roby_Sreejith]

I have configured Scheduled configuratio export for Panorama and all firewalls to an SCP server

This is done via Panorama.

Is there any way to schedule an email alert after evry succesful backup of configuration. Or in case of failed  export of configuration . I can see the SCP export happening through system logs in panorama.

I have filtererd with the SCP/SFTP server IP like below: Is it possible to filter this and create email alert:( custom email Alerts):

[kiwi]

Hi @Roby_Sreejith,

I haven't checked it myself yet but if there's a log generated then you could use PAN-OS 8.0 filtered log forwarding feature to accomplish this.

Hope this helps.

Cheers !

-Kiwi.

[Brandon_Wertz]

I'm curious, maybe I don't understand what you're trying to do but Panorama automatically takes a config backup everytime you make a commit change that's attached to panorama.  It stores 100 unqiue configs by default.  (I'm not sure why you'd need a seperate process to export the configs?)

[Roby_Sreejith]

There is is a problem with this bacakup. It stores in Panorama. I can not extarct this to locally. 

[Brandon_Wertz]

---

@Roby_Sreejith wrote:

There is is a problem with this bacakup. It stores in Panorama. I can not extarct this to locally. 

---

I guess I don't understand the requirement.  You need it "locally" and not in Panorama because Panorama has the potential to be inaccessible and if at that same time you have a firewall down and need to restore said firewall relying on Panorama is a failure point?

[Roby_Sreejith]

I beleive the backup in panoarama can not be extracted locally.

This stays in Panorama.

I have reqiremt of keeping a local backup copy of each firewall , so I choose an option to export to SCCP/SFTP server .

So I have control in backup procedure.

Now I need alert mechansim of which whethere this exort to SCP/SFTP server is success or not

[Roby_Sreejith]

I have added some more details in the discussion with detailed pictures. 

[Roby_Sreejith]

I have added the system logs screenshot in here. Can you tell me how to create custom email alerts for this issue. or is there any guide posted here for custom alerts

[fjwcash]

---

@Roby_Sreejith wrote:

I beleive the backup in panoarama can not be extracted locally.

This stays in Panorama.

I have reqiremt of keeping a local backup copy of each firewall , so I choose an option to export to SCCP/SFTP server .

So I have control in backup procedure.

Now I need alert mechansim of which whethere this exort to SCP/SFTP server is success or not

---

If it's not possible via Panorama, you can always script something up on the SCP/SFTP server side of things.  The auth log for SSH will show whether a connection occurred.  And you should be able to increase the verbosity of logs for SCP/SFTP connections to show more information on the connections/transfers.

You can always monitor the directory the files are being transferred to, and compare dates/times on the files.  And/or the file names, as they are named using the date of the backup.

[Roby_Sreejith]

Is it possible to a custom report ands schedule an email in Palo Alto onbnly for succesful /failed SCP SFT backup done from Panorama 

[T-Squared]

Yes this is possible using http server profiles and an external service called mailgun, I do it for commits.

[Roby_Sreejith]

Can you help which document to refer for this

[Roby_Sreejith]

any idea to configure email alert for this

[T-Squared]

Here is something that should help, I will keep it up till EOY. 

Tom

https://www.dropbox.com/s/18yo3d0k3qbxq8a/Mail-forwarding.pdf?dl=0

[Roby_Sreejith]

@kiwi I have checked and could not find this feature for filtering System logs, Have you tried this to filter system logs for specific pattern to crerate email alerts