Sending user logins via Syslog

[eharvey]

Hi all,

I have not found a way to send user logins to an external syslog server. I have traffic allows/denies coming through successfully, and "misc. system events." Is there a custom configuration that needs to be done to get user login date/time? We need this for compliance.

Thanks,

Eric H.

[essnet]

Objects -> Logging Profiles -> SNMP Traps/Syslog

Apply new profile to the rules you wish and also in Device->Log Settings->System

Works great here.

[eharvey]

I appreciate the attempt, but that's a pretty vague answer. I already have syslog configured correctly and am capturing logs. My question was pertaining to whether there was something I was missing. I don't see anything for "user logins" on my syslog appliance.

[sdurga · Accepted solution]

Hi Eric,

System logs on the PAN will have the login information of the users. So you can forward the system logs to the Syslog server. You can forward systems log's  to the server like below. System logs will have all kinds of information related to the device so if you do not want all the info and need just the login information in the Syslog's, try just forwarding informational system logs.

[eharvey]

Thank you. I thought the 'Panorama' option was only used for a separate piece of hardware provided by Palo Alto. Maybe I do not have the correct information.