TCPDUMP shows syslog traffic going to a specific destination - How to figure out what is sending it there?

[Art]

I am hoping this is an "easy" question that I am just missing having been on calls since 4:24 am this morning :smileyconfused:

I have used tcpdump to confirm that one of our PAN firewalls are sending syslog traffic to a specific destination (w.x.y.z) which it is not supposed to. (we don't want it going to that 'collector' for band width reasons - we have a 'closer' collector.

   Anyone have a trick to figure out what rule/construct is sending the syslog traffic to server w.x.y.z?

   BlueCoat has a "Trace" functionality on their SG-OS that shows the evaluation by each rule as the traffic is evaluated ... that would be helpful... is there a similar thing in PAN-OS?

Thanks

Art

[Phoenix]

Hello Art

If we look at the below image we see that the Traffic Log type has a field for "Rule" this would indicate the security rule name that is generating the log.

Hope this is exactly what is being looked for.

[Art]

Thanks Phoenix... great idea... I will look into it... turned out there was one rule I hadn't noticed that was configured incorrectly that was routing the traffic.

thanks

Art