logging for external dynamic lists?

[rjfoster]

Is there any logging for EDLs? I am looking for things like:

• a change in the EDL was detected
• errors in the EDL (invalid IPs or URLs)
• EDL is too large / too many entries

It would be great if I could alert on any of these.

[mshekh]

Hi @rjfoster ,

You can refer the system logs to check the status of EDL refresh, but it will not give the exact error if IPs or URLs are invalid in EDL. 

Regarding teh EDL is too large / too many entries, you will see the error in system logs.

You can refer the below doc related to formatting guidelines.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/use-an-external-dynamic-list-in-po...

Best Regards,

Mohammad Talib

[PavelK]

Hello @rjfoster

only to expand on answer given by @mshekh. Once you find EDL related errors in System log you want to get alerts, you can set up custom alerting from: Device > Log Settings > System > Add > Filter Builder:

Contains 'EDL' is a bit too generic and will be noisy. I am using it here only as an example 🙂

Kind Regards

Pavel

[rjfoster]

Thanks for the info. I was hoping there was a place to get more details. In particular, if a entry is bad, the firewall should provide details. Logging seems to be a strength for traffic and security--I was hoping system-level logging would be as detailed.

-r