Syslog to one or two servers with default and custom log format

[MikeSangray2019]

Hey all, I am wondering if this is possible. I understand this duplicates logging, but hopefully it's short-term.

I need to send syslog to either one server in default and custom log formats or send to two syslog servers one in default and the other in custom log format. It seems like the profile only allows for either default or custom log format, and I can only apply one profile per policy.

Really seems like an either/or situation, but I'm hoping I'm missing something.

[BPry · Accepted solution]

@MikeSangray2019,

You can't do this in a single syslog server profile, but that doesn't really matter. I would create one "Syslog-Default" and "Syslog-Custom" and then perform any modifications that you need to on the profile. PAN-OS will allow you to have two profiles with the same syslog server address/fqdn specified, so you can do this on a single server.

You would then modify your log-settings or log-forwarding profiles as needed and simply include both syslog profiles that you have created. This will allow you to see how both would come across and customize as needed. 

[MikeSangray2019]

This worked. Confusion here was around Device -> Server Profiles -> Syslog vs Objects -> Log Forwarding.