Query on Syslog filter builder

[tamilvanan]

Hi Folks,

We had configured to forward the system logs for severity of informational, medium, high and critical using filter builder. But we are receiving logs only for informational on our QRadar Syslog.

What is the supported format for System log forwarding in PA firewall, we can select only one severity type for each entry or multiple severity type filter for each entry.

Thanks in advance

[reaper]

you should be able to pick multiple, but have you tried setting that top one to (severity neq low) ?

[steven_yorke]

Have a similar issue with our device. It won't forward medium, high or critical events to the syslog server.

[MP18]

@tamilvanan 

We have this config for syslog 

system-infomational  filter  (severity eq informational)

system-low  filter  (severity eq low)

system-high filter  (severity eq high

system-medium  filter  (severity eq medium )

We are getting all the logs to the syslog server

Regards