High availability system alarms

[EduRamirez]

I can't find all the HA events. I need to map all the system alerts on my FW.

Searching the system logs, I find logs like the ones shown below, but I need to be able to map each one to my server to monitor alarms.

2025/08/25 06:03:57 high ha config- 0 HA Group 1: Commit on peer device with running configuration not synchronized; synchronize manually
2025/08/25 06:04:02 high ha peer-ve 0 HA Group 1: Anti-Virus version does not match
2025/08/25 06:04:02 high ha peer-ve 0 HA Group 1: Global Protect Client Software version does not match
2025/08/25 06:04:02 high ha peer-ve 0 HA Group 1: Application Content version does not match
2025/08/25 06:04:02 high ha peer-ve 0 HA Group 1: Threat Content version does not match
2025/08/25 06:04:05 high ha peer-ve 0 HA Group 1: Anti-Virus version does not match
2025/08/25 06:04:05 high ha peer-ve 0 HA Group 1: Global Protect Client Software version does not match
2025/08/25 06:04:05 high ha peer-ve 0 HA Group 1: Application Content version does not match
2025/08/25 06:04:05 high ha peer-ve 0 HA Group 1: Threat Content version does not match

This article lists some of the alarms, but the HA ones are missing, and I'm having trouble listing them.
https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syst...

Does anyone have a resource where I can look them up?

[BPry]

@EduRamirez,

I'm not aware of a resource where this is specifically detailed, but if you're using a normal SIEM (Graylog, Splunk, LogRythm, etc.) have their respective content packs that you can utilize  instead of having to build it out manually. If you've rolled your own maybe you can use Graylogs content pack to build out your extractors?