How to forward DHCP logs to syslog server (SIEM)

[Chris_Parsons]

Does anyone know how to set up forwarding of DHCP logs (leases being issued mainly) from a PAN device operating a DHCP server to a SIEM via syslog? I've already configured a log forwarding profile but I'm not seeing the appropriate DHCP lease logs in my SIEM.

[glastra1]

Are you sending the system logs to the syslog server?

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Forward-System-Logs-to-Syslog-Ser...

Are receiving other logs than the DHCP ones?

Regards,

Gerardo.

[ReimoS]

Hello

I also need help with the same issue, how can i forward DHCP lease info to SEIM/syslog server

[aleksandar.astardzhiev]

Hi @ReimoS ,

DHCP lease logs are subtype of system logs. To forward system logs to syslog you need:

1. Create syslog server profile for your SIEM collector

2. Config firewall to forward system logs to syslog by Device -> Log Settings -> System Logs

3. Optionally you can configure log filter to forward only DHCP related logs.