log forwarding to syslog | drops and queue

[FarkhanAliyev]

Hi everyone,

Can anyone advise what's wrong here. 

Issue with log forwarding to syslog PA 3250 running on 11.1.6-h10. Only few logs are being sent to server, others are dropped. Here is the flooding messages in the logrcvr log file:

2025/08/11 16:34:09 2025-08-11 16:34:09.382 +0400 Error: pan_logforward_enqueue_new(pan_logforward.c:2996): LOGFWD: enqueue task to syslog taskq(q_depth 0), log dropped
2025/08/11 16:34:09 2025-08-11 16:34:09.468 +0400 Error: pan_logforward_enqueue_new(pan_logforward.c:2996): LOGFWD: enqueue task to syslog taskq(q_depth 0), log dropped
2025/08/11 16:34:09 2025-08-11 16:34:09.498 +0400 Error: sendtcpsyslog(pan_syslog.c:1359): Reached max retry limit, ntotal: 0, errno: 11
2025/08/11 16:34:09 2025-08-11 16:34:09.498 +0400 Error: _pan_syslog(pan_syslog.c:1962): TCP send failure: data size: 1538, sent: 0, errno: 11

TCP port 514, switching to UDP dont help

Simple things like restarting log-receiver, mgmt, creating new syslog server and etc didn't help. We will probably open a case for this but if you know the possible solution will appreciate that.

[kiwi]

Hi @FarkhanAliyev ,

You might be hitting an existing bug where syslog connections from the FW to the syslog server is not established.

The bug-report as far as I can see is still unclear for a fix version in 11.1.x

I'd recommend reaching out to TAC to confirm if you're hitting the exact same bug (PAN-255253) or if you're hitting an entirely different issue.

Kind regards,

-Kim.

[FarkhanAliyev]

Thanks for your prompt. Just opened a ticket, will update here as we get reply.