Syslog multiple configurations

[vseward]

I am having no issues actually sending syslog data.  The issue is sending to much over the network.  I have two different applications that require syslog data from the firewalls.  One application requires all the logs with all the content.  The other application only requires a limited number of fields in the trafic log and all of the change log.  I am able to send all the logs and all the data to both applications with realitive easy but I cant seem to be able to configure each differently.  Is it possible to configure them seperately using Panorama?

Thanks

Victor

[kiwi]

Hi @vseward,

In PAN-OS 8.0 you can add multiple log forwarding profiles with each profile having its own forwarding filters :

Hope this helps.

Cheers !

-Kiwi.

[vseward]

So to be clear on version 8 of PAN OS each firewall rule can have multiple Log Forwarding Profile setting sending to different syslog servers?

[vseward]

By the way if you don't have the Log Forwarding Profile setting set under options on any of the firewall policy rules what data is sent to the syslog server if you do have a syslog set on Device -> Server Profiles -> syslog?

[kiwi]

Hi @vseward,

Not exactly.  The screenshot from my previous comment was referring to the PAN-OS 8.0 System logs setting under Device > Log Forwarding (similar to Device > Log Settings > System in 7.1).

In your policies, you can only have one Log Forwarding Profile configured per rule ... that said, in PAN-OS 8.0 you can add multiple 'Log Forwarding Profile Match List' to your 'Log Forwarding Profile'.

You can always add multiple syslog servers to your existing syslog server profile (this is also possible in PAN-OS 7.1)

This might help you on the filtered log forwarding feature in PAN-OS 8.0:

https://live.paloaltonetworks.com/t5/Tutorials/Tutorial-Filtered-Log-Forwarding/ta-p/145950

If you don't add a forwarding profile to a rule then no data is forwarded for that rule.

Cheers !

-Kiwi.