Palo Alto Syslog severity level compare to Syslog Protocol RFC 5424

[Amir.Borjian]

Hi guys,

Do you know how Palo Alto interpret the standard Syslog protocol severity;

RFC 5424 The Syslog Protocol

Numerical         Severity

0       Emergency: system is unusable

1       Alert: action must be taken immediately

2       Critical: critical conditions

3       Error: error conditions

4       Warning: warning conditions

5       Notice: normal but significant condition

6       Informational: informational messages

7       Debug: debug-level messages

[kattaullah]

Hello Amir

The syslog severity is based on the log type and contents. Below are the details

Log Type Severity                                                Syslog Severity

TRAFFIC                                                                   INFO

CONFIG                                                                    INFO

THREAT/SYSTEM –Informational                       INFO

THREAT/SYSTEM – Low                                      NOTICE

THREAT/SYSTEM – Medium                              WARNING

THREAT/SYSTEM – High                                    ERROR

THREAT/SYSTEM – Critical                                CRITICAL

Hope that helps.

Regards

Khan

Note: Please mark any helpful or correct answers.

[Amir.Borjian]

Thanks Khan,

I would say it's sort of a correlation between them which is helpful in the UNIX environment.

Just checked Splunk and the severity levels are identical.

Thanks again.

Amir