Is it possible to re-send system logs to a syslog server

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Is it possible to re-send system logs to a syslog server

L2 Linker

If this syslog server connection has been down, and I would like to send all previously unsent logs during that downtime to the syslog, is this possible?

 

Thanks in advance

1 accepted solution

Accepted Solutions

Hi @s0lselcia ,

As far as I am aware there is no easy way to do that...Especially if you are using UDP for syslog. If Syslog over UDP was used there is no way for the firewall to know if remote syslog server is up or down as there is no acknowledgment. I am not completely sure if TCP is used...In theory it should provide the necessary information for FW to know when exactly remote syslog stopped receiving logs, but I don't have real experiance if it will resume from that point or again from the moment TCP connection is re-established.

 

The only workaround I can think of is log export to SCP or FTP server - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clj3CAC (bottom of the page follow the steps for CLI export)

View solution in original post

1 REPLY 1

Hi @s0lselcia ,

As far as I am aware there is no easy way to do that...Especially if you are using UDP for syslog. If Syslog over UDP was used there is no way for the firewall to know if remote syslog server is up or down as there is no acknowledgment. I am not completely sure if TCP is used...In theory it should provide the necessary information for FW to know when exactly remote syslog stopped receiving logs, but I don't have real experiance if it will resume from that point or again from the moment TCP connection is re-established.

 

The only workaround I can think of is log export to SCP or FTP server - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clj3CAC (bottom of the page follow the steps for CLI export)

  • 1 accepted solution
  • 826 Views
  • 1 replies
  • 0 Likes
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!