Add a Log Forwarding App Instance

Create an instance of the Log Forwarding app to send logs from the Logging Service to an external destination.
Log Forwarding is included with Logging Service and does not require any additional licensing. Before you can use Log Forwarding, you must activate it on the Cloud Services Portal. After you activate the app, you can add a Log Forwarding app instance to the Cloud Services Portal. Although you only need to activate the Log Forwarding app one time, you must add a separate Log Forwarding app instance for each instance of the Logging Service you have purchased. Each instance of the Log Forwarding app can forward logs to a single destination, and you can associate it with only one instance of the Logging Service.
In addition, before you can activate or add a Log Forwarding app instance, you must have the Logging Service role assigned to your user account. If you do not have this role, you will not be able to see or manage the Logging Service or the Log Forwarding app from the Cloud Services portal.
Use the following workflow to activate the Log Forwarding App and add an instance of the app.
  1. Sign In to the Cloud Services Portal at https://apps.paloaltonetworks.com/.
    If you do not see the Logging Service or the Log Forwarding app as available Palo Alto Networks apps, you do not have the Logging Service user role assigned to your user account. In this case, the Superuser on your support account must assign the Logging Service role on the Customer Support Portal.
  2. To activate the Log Forwarding app, select the Log Forwarding app tile and click Activate.
    This is a one-time task for your customer account. If you have already activated the app, go to the next step.
    activate-lf-app.png
  3. Select the gear icon gear_icon.PNG and then Add Instance to add a new Log Forwarding app instance.
    add-lf-app.png
    Your company name and the license type displays on the Activate Log Forwarding page.
  4. Enter an Instance Name (up to 63 characters) and a Description to help you identify the Log Forwarding app instance.
  5. Select the Region in which you have deployed the Logging Service instance from which you want to forward logs.
  6. Choose an available Logging Service instance from the region you selected.
    A Logging Service instance can forward logs to only one Log Forwarding app. The drop-down displays Logging Service instances that are running ( healthy.PNG ) and shows you which instances are available and which are attached to an instance of the Log Forwarding app.
  7. Click Agree and Activate, to accept the terms of the End User License Agreement.
    The app instance is launched, and the status indicates when the app is available for configuration.
  8. Continue to Forward Logs from the Logging Service to a Syslog Server and Forward Logs from the Logging Service to an Email Server.

Related Documentation