08-11-2021 01:58 AM
As per title, I have this problem on a HA scenario with two VM-100 installed on VMware. Practically every 20 min in the system logs appears:"Syslog connection broken to server". After 0 sec appears:"Syslog connection is established to server".
Can someone help me to better understand what it is?
OS version 10.0.5
09-05-2021 07:14 PM
I had the same issue in the past. There are several reasons for triggering this. In order to drill down into a route cause, would it be possible to get syslog logs from CLI from Active Firewall: tail lines 100 mp-log syslog-ng.log.1
Also, would it be possible to take packet capture from management interface (Assuming you are using management interface to send syslog)? Here is the manual: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleECAS You can use for example this filter: tcpdump filter "host <IP address of your syslog server>", then please export it and check it in Wireshark to see reason for closing of the session.
In one of my case, the closing reason was periodic TCP FIN. This got resolved by changing timer on server side to keep connection open for longer period.
Since, you mentioned that connection gets broken and re-established periodically, this might be the root cause. Could you please confirm what server product you are sending syslog to? Based on what we see in the syslog-ng.log or from packet capture, I would decide what steps to take next for troubleshooting.
I hope this helps to narrow down what the root cause is.
Thank you and Regards
05-11-2022 11:30 PM
thank you for the comment. Since the passive Firewall does not actively process any traffic, syslog connection will not be sending any Traffic, URL, Threat logs,... The only log that is being generated on passive Firewall is System and Configuration logs. If this log is being sent by syslog out to your server, then as a next thing I would be looking into packet capture to see what side is closing connection.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!