06-20-2023 03:39 AM
If this syslog server connection has been down, and I would like to send all previously unsent logs during that downtime to the syslog, is this possible?
Thanks in advance
06-20-2023 03:58 AM
Hi @s0lselcia ,
As far as I am aware there is no easy way to do that...Especially if you are using UDP for syslog. If Syslog over UDP was used there is no way for the firewall to know if remote syslog server is up or down as there is no acknowledgment. I am not completely sure if TCP is used...In theory it should provide the necessary information for FW to know when exactly remote syslog stopped receiving logs, but I don't have real experiance if it will resume from that point or again from the moment TCP connection is re-established.
The only workaround I can think of is log export to SCP or FTP server - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clj3CAC (bottom of the page follow the steps for CLI export)
06-20-2023 03:58 AM
Hi @s0lselcia ,
As far as I am aware there is no easy way to do that...Especially if you are using UDP for syslog. If Syslog over UDP was used there is no way for the firewall to know if remote syslog server is up or down as there is no acknowledgment. I am not completely sure if TCP is used...In theory it should provide the necessary information for FW to know when exactly remote syslog stopped receiving logs, but I don't have real experiance if it will resume from that point or again from the moment TCP connection is re-established.
The only workaround I can think of is log export to SCP or FTP server - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clj3CAC (bottom of the page follow the steps for CLI export)
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
