Syslog Server Support in Prisma SD-WAN
Table of Contents
Expand all | Collapse all
-
-
- Configure Circuits
- Configure Circuit Categories
- Configure Device Initiated Connections for Circuits
- Add Public IP LAN Address to Enterprise Prefixes
- Add a Branch
- Add a Data Center
- Manage Data Center Clusters
- Configure a Site Prefix
- Configure a DHCP Server
- Configure NTP for Prisma SD-WAN
- Enable IoT Device Visibility in Prisma SD-WAN
- Configure the ION Device at a Branch Site
- Configure the ION Device at a Data Center
- Switch a Site to Control Mode
- Allow IP Addresses in Firewall Configuration
-
- Configure a Controller Port
- Configure Internet Ports
- Configure WAN/LAN Ports
- Configure a Sub-Interface
- Configure a Loopback Interface
- Configure a PPPoE Interface
- Configure a Layer 3 LAN Interface
- Configure Application Reachability Probes
- Configure a Secondary IP Address
- Configure a Static ARP
- Configure a DHCP Relay
- Configure IP Directed Broadcast
-
-
- Configure IPFIX
- Configure IPFIX Profiles
- Configure IPFIX Templates
- Configure Collector Contexts
- Configure Filter Contexts
- Configure Global IPFIX Prefixes
- Configure Local IPFIX Prefixes
- Attach an IPFIX Profile to an ION Device
- Attach a Collector Context to a Device Interface
- Attach a Filter Context to a Device Interface
- Configure High Availability (HA) for IPFIX
- Flow Information Elements
- Options Information Elements
- Configure SNMP
-
-
-
- Prisma SD-WAN Branch Routing
- Prisma SD-WAN Data Center Routing
-
- Configure Multicast
- Create a WAN Multicast Configuration Profile
- Assign WAN Multicast Configuration Profiles to Branch Sites
- Configure a Multicast Source at a Branch Site
- Configure Global Multicast Parameters
- Configure a Multicast Static Rendezvous Point (RP)
- Learn Rendezvous Points (RPs) Dynamically
- View LAN Statistics for Multicast
- View WAN Statistics for Multicast
- View IGMP Membership
- View the Multicast Route Table
- View Multicast Flow Statistics
- Prisma SD-WAN Incident Policies
-
- Prisma SD-WAN Branch HA Key Concepts
- Configure Branch HA
- Configure HA Groups
- Add ION Devices to HA Groups
- View Device Configuration of HA Groups
- Edit HA Groups and Group Membership
-
- Configure Branch HA with Gen-1 Platforms (2000, 3000, 7000, and 9000)
- Configure Branch HA with Gen-2 Platforms (3200, 5200, and 9200)
- Configure Branch HA with Gen-2 Embedded Switch Platforms (1200-S or 3200-L2)
- Configure Branch HA for Devices with Software Cellular Bypass (1200-S-C-5G)
- Configure Branch HA for Platforms without Bypass Pairs
-
-
- Native SASE Integration with Prisma SD-WAN
- Connect a Single Prisma SD-WAN Site to Prisma Access
- Connect Multiple Prisma SD-WAN Sites to Prisma Access
- Edit Application Policy Network Rules
- Understand Service and Data Center Groups
- Verify Standard VPN Endpoints
- Configure Standard Groups
- Assign Domains to Sites
- Prisma SD-WAN Incidents and Alerts
Syslog Server Support in Prisma SD-WAN
Prisma SD-WAN
Prisma SD-WAN Syslog is a protocol through which network devices send event messages over
User Datagram Protocol (UDP) /Transmission Control Protocol (TCP) to a Syslog
server.
Prisma SD-WAN
ION devices provide Syslog
support to log and export flow and event information to Syslog servers.Syslog is a protocol through which network devices send event
messages over User Datagram Protocol (UDP) /Transmission Control
Protocol (TCP) to a Syslog server. As a wide range of devices support
the protocol, you may use it to log different events. For example,
device user session logins or access-denied events are some of the
events you may send to a Syslog server.
A Syslog server can reside inside or outside of a branch or a
data center or in the cloud. The maximum number of Syslog servers supported
per ION device is 16. The ION devices use the Syslog protocol to:
- Forward device events such as alerts and alarms to a remote Syslog server(s).
- Forward device Authentication logs to a remote Syslog server(s).
- Forward flow logs to a remote Syslog server(s).
Event Logs
Event logs are generated in
response to alerts and alarms in the device. Below is a sample event
log message sent to a Syslog server.
Feb 14 10:38:11 172.20.75.186 alert: CLOUDGENIX_HOST="ion7k-Hub" DEVICE_TIME="2018-02-14T10:36:49.000" STATUS="Not cleared" CODE="DEVICESW_GENERAL_PROCESSRESTART"SEVERITY="minor" PROCESS_NAME="event_forward" ELEMENT_ID="15174644824510129"Feb 14 10:38:11 172.20.75.186 alert: CLOUDGENIX_HOST="ion7k-Hub" DEVICE_TIME="2018-02-14T10:37:22.000" STATUS="Not cleared" CODE="DEVICESW_GENERAL_PROCESSRESTART"SEVERITY="minor" PROCESS_NAME="scm" ELEMENT_ID="15174644824510129"
Authentication Logs
Authentication logs
are generated when a user is authenticated to login to the device.
Below is a sample Auth log message sent to a Syslog server.
Feb 14 10:44:58 172.20.75.186 log: CLOUDGENIX_HOST="ion7k-Hub" DEVICE_TIME="2018-02-14T10:44:58.881Z" MSG="sshd-login keyboard-interactive/pam" SEVERITY="minor"PROCESS_NAME="sshd" FACILITY="auth" USER="elem-admin" ELEMENT_ID="15174644824510129"
While configuring Syslog export on the device, you can filter using
severity levels for logs/events to export to the Syslog server. You may configure
severity levels as critical, major, or minor. The default severity level is
minor.
When you set a severity level for a device, logs and events for the selected severity
level and higher are exported to the Syslog server. For example, if the chosen
severity level is major, then all major and critical events and logs will be
forwarded to the Syslog server.