link-change still informational severity?

[TonyDeHart]

Can someone explain to me the rational behind allowing an interface to drop and having the link-change log a down state and yet have it be INFORMATIONAL severity level? I saw an old question about this and it seems somewhat ridiculous?  We had filtering on higher severity levels and had a circuit drop and never got the alert and then realized why.

Just curious if anyone understands the reasoning behind this?

[JayGolf]

Hi @TonyDeHart ,

Could you share a screenshot of the alert and blur any IPs/Names? I typically have seen "Critical" for alerts such as VPN tunnel down or interface being down on the Palo. Here is a link to the system logs doc.

[TonyDeHart]

This is straight out of the system log from a link dropping on us.  Bonus for the HSCI being in there. 🙂

Our alerting was ignoring information as far as getting a text/email so we never knew until other services dropped that the link had failed on the firewall.

[Raido_Rattameister]

Yeah those events are informational.

I have dedicated syslog/email alert set up under "Device > Log Settings > System" with filter ( subtype eq port ).

You can also be more specific with "( subtype eq port ) and ( eventid eq link-change )" to notify you.

[TonyDeHart]

Thanks. That is essentially what I did after I discovered this but I was more curious what, if anything, is the rational behind a port going doing being informational? Not sure if anyone from Palo Alto chimes in but how is this not a more critical type of alert?

[Raido_Rattameister]

It would be nice if alert severities for different events could be adjusted by admin.

For example in tiny office that has no switch and workstations connect directly to firewall it would be noisy if every workstation reboot causes critical alert in firewall.

On the other hand if firewall is in the datacenter then it is definitely event to pay attention to.