Issue in the syslog message format in Palo Alto 6 beta 1

[NHorsch]

Hello,

I am currently on Palo Alto v 6.0.0-b23 and facing an issue with the format of syslog message.

if we pass the same malicious file through Palo Alto device, syslog message forwarded by Palo Alto v5.0.6 and v6.0 beta are different. Palo Alto 5.0.6 forwards threat name and ID while Palo Alto 6 beta forward threat ID twice.

Log on Palo Alto 6.0

Dec 05 22:38:41 10.208.35.87 Dec  5 22:36:06 PA-VM 1,2013/12/05 22:36:06,007000001148,THREAT,virus,1,2013/12/05 22:36:01,xx.xx.xx.xx,xx.xx.xx.xx,0.0.0.0,0.0.0.0,Test,,,ftp,vsys1,Trust,Untrust,ethernet1/1,ethernet1/2,Log Forwarding,2013/12/05 22:36:06,38355,1,49512,53627,0,0,0x0,tcp,deny,"filename",2001508(2001508),any,medium,server-to-client,0,0x0,192.0.0.0-192.255.255.255,192.0.0.0-192.255.255.255,0,,0,,,

Log on Palo Alto 5.0.6

May  2 06:33:42 10.102.102.45 1,2013/05/02 06:33:42,0006C111278,THREAT,virus,1,2013/05/02 06:33:36,xx.xx.xx.xx,xx.xx.xx.xx,,,rule2,,,ftp,vsys1,trust,trust,ethernet1/2,ethernet1/1,server-1,2013/05/02 06:33:41,9761,1,32277,44445,0,0,0x80000000,tcp,deny,"filename",Trojan/Win32.Loring.a(2001508),any,medium,server-to-client,81,0x0,192.0.0.0-192.255.255.255,192.0.0.0-192.255.255.255,0,

Is this change intentional or will it be fixed in the GA version or already fixed in the beta 4?

[goku123]

Please report this issue to the Beta support alias for investigation at : betasupport@paloaltonetworks.com