@SteveCantwell Thanks for the quick reply. I think you might be on to something. On the Panorama Management I have the two CG, Default and Remote. Both have Device Log Forwarding and Collector Log Forwarding set up. Are you saying that I should only have the Collector Log Forwarding set up? Both the Default and Remote CG have (on the Collector Log Forwarding tab) the same syslog info on each of the tabs (system, configuration, HIP Match and so on). So will I have just one Collector Group at the end of all this or two? I'm not exactly sure what you mean by " I am curious if you have removed, from the Default log collector group, all configurations regarding the log forwarding of notifications". On the Panorama Mgt under Objects > Log Forwarding I do have an entry for Log_Forward which has the check box for Panorama/Logging Service checked. On the local FW's under Device > Server Profiles > Syslog there is no entry. Under Device > Log Settings there is a template setting for each of the System, Configuration, User-ID and so on set up and they to have the forward method as Panorama checked. I did talk to Palo support, but he wasn't much help to be honest.
... View more