Focus

PAN-OS Web Interface Help

Panorama > Log Settings

Table of Contents

Panorama > Log Settings

Use the Log Settings page to forward the following log types to external services:

System, Configuration, User-ID, and Correlation logs that the Panorama management server (M-Series appliance or Panorama virtual appliance in Panorama mode) generates locally.
Logs of all types that the Panorama virtual appliance in Legacy mode generates locally or collects from firewalls.

For the logs that firewalls send to Log Collectors, complete the Log Collector Configuration to enable forwarding to external services.

Before starting, you must define server profiles for the external services (see Device > Server Profiles > SNMP Trap, Device > Server Profiles > Syslog, Device > Server Profiles > Email, and Device > Server Profiles > HTTP). Then Add one or more match list profiles and configure the settings as described in the following table.

Match List Profile Settings	Description
Name	Enter a name (up to 31 characters) to identify the match list profile.
Filter	By default, Panorama forwards All Logs of the type for which you are adding the match list profile. To forward a subset of the logs, open the drop-down and select an existing filter or select Filter Builder to add a new filter. For each query in a new filter, specify the following fields and Add the query: Connector—Select the connector logic (and/or) for the query. Select Negate if you want to apply negation to the logic. For example, to avoid forwarding logs from an untrusted zone, select Negate, select Zone as the Attribute, select equal as the Operator, and enter the name of the untrusted Zone in the Value column. Attribute—Select a log attribute. The options depend on the log type. Operator—Select the criterion to determine whether the attribute applies (such as equal). The available options depend on the log type. Value—Specify the attribute value for the query to match. To display or export the logs that the filter matches, select View Filtered Logs. This tab provides the same options as the Monitoring tab pages (such as MonitoringLogsTraffic).
Description	Enter a description of up to 1,024 characters to explain the purpose of this match list profile.
SNMP	Add one or more SNMP Trap server profiles to forward logs as SNMP traps (see Device > Server Profiles > SNMP Trap).
Email	Add one or more Email server profiles to forward logs as email notifications (see Device > Server Profiles > Email).
Syslog	Add one or more Syslog server profiles to forward logs as syslog messages (see Device > Server Profiles > Syslog).
HTTP	Add one or more HTTP server profiles to forward logs as HTTP requests (see Device > Server Profiles > HTTP).
Built-in Actions	All log types except System logs and Configuration logs allow you to configure actions. Add an action and enter a name to describe it. Select the IP address you want to tag—Source Address or Destination Address. Select the action—Add Tag or Remove Tag. Select whether to distribute the tag to the local User-ID agent on this device, or to a remote User-ID Agent. To distribute tags to a Remote device User-ID Agent, select the HTTP server profile that will enable forwarding. Configure the IP-Tag Timeout to set, in minutes, the amount of time that IP address-to-tag mapping is maintained. Setting the timeout to 0 means that the IP-Tag mapping does not timeout (range is 0 to 43200 (30 days); default is 0). You can only configure a timeout with the Add Tag action. Enter or select the Tags you want to apply or remove from the target source or destination IP address. You can tag the source IP address only, in Correlation logs and HIP Match logs.

Panorama > Log Ingestion Profile

Panorama > Server Profiles > SCP