Config/System Logs Not Forwarding to Syslog Server

[V.Sambath]

I am currently facing an issue where Configuration and System logs are not being forwarded to the syslog server, even though the configuration appears to be correct.

• Standalone Firewall
• PAN-OS Version: 11.x
• Syslog Server: (configured and reachable for traffic logs)

Anyone encountered this issue? despite being following the ref article by Palo? 

How to Forward Config Logs to Syslog Server 

[V.Sambath]

[BPry]

@V.Sambath,

A couple of questions:

1. Was this working previously, or is this a brand new setup that has never worked?
2. Have you verified whether or not you're actually seeing traffic from the firewall on the receiving node or not? Depending on the system and the way that it's configured, it could be dropping the logs because it's failing to parse them. 
3. If the traffic crosses the dataplane (IE: if your MGMT interface routes through your firewall to reach your syslog server or you utilize a dataplane interface to send the logs) have you verified that the firewall is attempting to send the logs? 

[V.Sambath]

1. This is an existing setup. Traffic and other logs are being successfully forwarded to the syslog server; however, Config and System logs have never been forwarded.

2. Service Route is currently set to "Use Default." 

3. Since traffic logs are working, it appears the dataplane path is fine. I also tried validating logs sent and I could see that Config logs are sent as expected. Below o/p, 

[ChrisWietharn]

Having the same issue since early February, opened a case with Palo.

All other syslog types are sending

Running 11.1.13

CLI syslog forwarding show dequeued packets, but most of the time no sent packets.

Interesting on a reboot or restart of the management plane it will then dump all the config logs but still broke after the reboot.  Seeing dropped packets.  Palo and Syslog server are on the same zone.

Have a DR firewall same hardware, PAN-OS, syslog configuration and same syslog server and its working.

I believe Palo has a bug in 11.1

[V.Sambath]

@ChrisWietharn  Today I noticed a strange thing, when i execute >debug log-receiver statistics,  my Config logs written rate is not increasing whereas System logs are continue to increase. Despite of this, no logs are sent. I am gonna clear the session between Syslog and MGT IP and see the results. Has Palo provided a fix for this issue to date?

Line   22: Config logs written:           4334

Line 257: Config logs written:           4334

Line 491: Config logs written:           4334