PAN-OS logs

[shahar.dorfman]

I looking for the log file that tracks the IP addresses of devices that have connected to our Palo Alto Networks firewall.

I am interested in any logs that show source and destination IP addresses for network connections.

Could you please point me to the file path or location of these logs? If they are exported or stored in a specific directory, that information would be very helpful.

[Brandon_Wertz]

It's going to be in your "Global Protect" log type.  You'll need to do some search strings to identify the successful login as well as using the "host ID" field.  You're also going to be limited on how much storage you've allocated to this log type.

--edit-- If you're just simply referring to an administrator that's logged into your firewall those logs would be in the system logs.

[shahar.dorfman]

Thanks! Could you please refer me to the exact path of the log files? As I’m having a hard time finding them🙏

[shahar.dorfman]

Just clarifying - I'm looking for the log file that logs the IP that used http to connect to my PAN-OS.

Thanks in advanced!

[Brandon_Wertz]

---

@shahar.dorfman wrote:

Thanks! Could you please refer me to the exact path of the log files? As I’m having a hard time finding them🙏

---

From the GUI:

Monitor tab --> System logs

[shahar.dorfman]

Is there a way to read them directly from the file? 

[BPry]

@shahar.dorfman,

Can you describe a bit more on what you're actually looking to do and why you're interested in reading them from the log files directly? That's a bit of an odd request; there's multiple ways to read the logs programmatically, send automated alerts when someone logs into the system, and so on without ever reading authd.log directly.