Log Forwarding of Traffic Logs to External Syslog server

[Mark.Hamilton]

Hi, we have firewalls configured to send their logs to Panorama Log Collectors and now want to forward the logs from there to a new Splunk server. We have configured the Log Collectors to forward certain log types (e.g. system, threat, traffic, url) to the Splunk server but in Splunk we only see the system logs and not the traffic logs.

[PavelK · Accepted solution]

Hello @Mark.Hamilton

thanks for the post.

The setting to send logs from log collectors to 3rd party Syslog server is under: Panorama > Collector Groups > [Log Collector Group Name] > Collector Log Forwarding. If you have configured your Syslog server under: Traffic, Threat, URL,... then there is no other configuration step required.

To apply this change, make sure you commit and then push the configuration to log collectors by: Commit > Push to devices, then select log collector group. Without the pushing it to log collector group, the logs will not be sent from log collectors to Syslog server.

Kind Regards

Pavel 

[Mark.Hamilton]

Thanks Pavel, you were right. For some reason I also had to change the syslog servers to use UDP instead of TCP like we wanted but I think that was more to do with the external servers however the main thing was pushing to the Collector Groups - I didnt realise that because when you try and to a "Commit and Push" after making changes to the Collector Groups they dont automatically appear and you have to go and manually select them. Thanks again for your help.