Threat,virus Log

[NHorsch]

Oct 27 23:00:32 10.208.35.87 Oct 27 22:57:23 PA-VM 1,2013/10/27 22:57:22,007000001148,THREAT,virus,1,2013/10/27 22:57:22,192.168.1.73,192.168.2.71,0.0.0.0,0.0.0.0,Test,,,ftp,vsys1,Trust,Untrust,ethernet1/1,ethernet1/2,Log Forwarding,2013/10/27 22:57:22,9906,1,49497,53510,0,0,0x80000000,tcp,deny,"eicar.com",100000(100000),any,medium,server-to-client,0,0x0,192.168.0.0-192.168.255.255,192.168.0.0-192.168.255.255,0,,1199317001038725136,,,

i have seen on extra field added in the default syslog format of the threat log ..marked as red as you can see above....what is the name of the field and its significance?

I didn't find the updated syslog integration document on the palo alto website....can you people please update the same.

[kadak · Accepted solution]

Hello NHorsch,

That number (1199317001038725136.....) would be the sequence number which is a 64bit log entry identifier that increments sequentially. Each log type has a unique number space.

Thanks and regards,

Kunal Adak

[NHorsch]

Thanks kadak for replying...

I have a doubt.....

But it does not appear in every log line....it is in only THREAT,virus log line.....

If its an incremental number then it should also present in other logs too.

[mikand]

In which PANOS did this show up and why isnt the syslog integration document updated with this field if its wellknown within PA?