How to set selective syslog server?

[Theerdam]

Can I set palo alto to check if syslog server is up before forwarding the log, and if the main syslog server is down then forward log to another server?

I have issues that I need palo alto to not forwarding logs to both servers at the same time.

[PavelK · Accepted solution]

Thank you for posting question @Theerdam

I was researching this topic and doing some verification. Regardless of PAN-OS version there can be up to 4 syslog servers configured in one syslog server profile, however there is no logic / connection check. Syslog server profile is sending logs to all targets simultaneously. One way to go around it would be to send all the logs to Virtual IP address of Load Balancer, then based on health check send logs to either of the real syslog server.

Kind Regards

Pavel

[pchevveti]

Hi, I have one query here. 
Imagine the Syslog server is down for a few hours, and later once the syslog server is up again, will the firewall send fresh logs or the meantime logs as well ?

[MP18]

@pchevveti 

If the syslog server is down then as per my understanding firewall will store logs locally and once server is up it will send old new logs.

Regards

Mahesh