Questions on logs export

[deshaw]

Hello,

I am setting up Palo Alto Firewall and want to export logs in CSV format to a UNIX filer daily at a specified time of the day. I have these questions:

• How do I schedule log export job so that it exports logs of only that particular day (and not all log history)?
• What is the default size of the log buffer? If log buffer gets full before the scheduled export time, I want to export logs before they get overwritten. How to do this?

Also CSV files shows many columns, many of which are redundant. Where can I modify those columns?

Thanks.

[mikand]

A workaround might be to use syslog from paloalto which outputs by default in csv format.

You can also in the custom log format define your own setup like if you dont like some columns.

[reaper · Accepted solution]

Hi!

In the device tab there is a section called "scheduled log export". this will allow you to set a scheduled daily event where the previous day's logs are exported in csv format and ftp'd/scp'd onto a server of your choice.

The only thing you'd need to verify is if your log volume allows you at least a full day's worth of logs, you can quickly check what the last log entry is to make sure there's enough headroom for the daily export to be successful

> show log traffic

regards

Tom

[_slv_]

Hi

Are you sure about ability to SCP logs to server?

I have 4.1.10 PAN and I see only FTP settings for export.

How to make scp?

regards

SLawek

[deshaw]

we are running 5.0.2...

[reaper]

Hi

the scp option became available in PANOS 5.0, in 4.1 you can only use ftp to transport the daily log export

regards

Tom