Need help in setting up the email alerts for the Pan firewalls.

[nmsecteam]

I am trying to setup email alerts when the device goes down or the interface goes down.

To complete this task, I had configured the email server and under the device tab -- log settings-- critical -- I set it to be forwarded to the email server.

Also when configuring the email server profile, under the custom log format, under system I chose the following fields

$severity$module$actionflags$object$time_generated

I am getting the alerts, but none of these alerts have the ip address or any device information. Does any one know, what fields I need to choose to get the device information like the hostname

[UhMayYeah]

Two Options:

Prominent option

> Choose the 'Display name' in the Email Server profile to reflect the Hostname/IP address.

Cryptic Option:

>You can choose the 'Serial No' field in the  Custom Log Format "$serial" which is a distinctive identifer for every device.

Regards,

AK

[nmsecteam]

Ameya,

I dont see the option for "display name/ip address". I only see, the serial no, which for me is not an ideal case scenario.

Praveen

[UhMayYeah]

Display name configured in the Email Server Profile which needs to be associated with the Log settings would show up in the "From:" field of the email notifications.

Eg:

Configure Email server profile say Test with Display name =Host name[Device>Server Profile> Email]

Associate this profile with the System Logs -Critical severity  [Device>Log Settings> System >Critical]

You would receive email notifications with the from feild populated with the Host name 

eg.From:Host-ABC  <ak@xyz.com>

Please check the highlighted portion in this snapshot.

Refer https://live.paloaltonetworks.com/docs/DOC-2390

Regards,

Ameya