Receive Time (receive_time or cef-formatted-receive_time) | Time the log was received at the management
plane. |
Serial Number (serial) | Serial number of the device that generated
the log. |
Type (type) | Specifies the type of log; value is CONFIG. |
Threat/Content Type (subtype) | Subtype of the configuration log; unused. |
Generated Time (time_generated or cef-formatted-time_generated) | Time the log was generated on the dataplane. |
Host (host) | Hostname or IP address of the client machine |
Virtual System (vsys) | Virtual System associated with the configuration
log |
Command (cmd) | Command performed by the Admin; values are
add, clone, commit, delete, edit, move, rename, set. |
Admin (admin) | Username of the Administrator performing
the configuration |
Client (client) | Client used by the Administrator; values
are Web and CLI |
Result (result) | Result of the configuration action; values
are Submitted, Succeeded, Failed, and Unauthorized |
Configuration Path (path) | The path of the configuration command issued;
up to 512 bytes in length |
Before Change Detail (before-change-detail) | This field is in custom logs only; it is
not in the default format. It contains the full xpath before
the configuration change. |
After Change Detail (after-change-detail) | This field is in custom logs only; it is
not in the default format. It contains the full xpath after
the configuration change. |
Sequence Number (seqno) | A 64bit log entry identifier incremented
sequentially; each log type has a unique number space. |
Action Flags (actionflags) | A bit field indicating if the log was forwarded
to Panorama. |
Device Group Hierarchy (dg_hier_level_1
to dg_hier_level_4) | A sequence of identification numbers that
indicate the device group’s location within a device group hierarchy.
The firewall (or virtual system) generating the log includes the
identification number of each ancestor in its device group hierarchy.
The shared device group (level 0) is not included in this structure. If
the log values are 12, 34, 45, 0, it means that the log was generated
by a firewall (or virtual system) that belongs to device group 45,
and its ancestors are 34, and 12. To view the device group names
that correspond to the value 12, 34 or 45, use one of the following
methods: API query: /api/?type=op&cmd=<show><dg-hierarchy></dg-hierarchy></show>
|
Virtual System Name (vsys_name) | The name of the virtual system associated
with the session; only valid on firewalls enabled for multiple virtual
systems. |
Device Name (device_name) | The hostname of the firewall on which the
session was logged. |
Device Group (dg_id) | The device group the firewall belongs to
if managed by a Panorama™ management server. |
Audit Comment (comment) | The audit comment entered in a policy rule
configuration change. |
High Resolution Timestamp (high_res_timestamp) | Time in milliseconds the log was received
at the management plane. The format for this new field is
YYYY-MM-DDThh:ss:sssTZD: YYYY—Four digit year MM—Two-digit month DD—Two-digit day of the month (01 through 31) T—Indicator for the beginning of the timestamp hh—Two-digit hour using 24-hour time (00 through 23) mm—Two-digit minute (00 through 59) ss—Two-digit second (00 through 60) sss—One or more digits for millisecond TZD—Time zone designator (+hh:mm or -hh:mm)
The
High Resolution Timestamp is supported for logs received from managed
firewalls running PAN-OS 10.0 and later releases. Logs received from
managed firewalls running PAN-OS 9.1 and earlier releases display
a 1969-12-31T16:00:00:000-8:00 timestamp
regardless of when the log was received. |
