Authentication Syslog Default Field Order

Example Authentication log in Syslog:
Oct 13 01:21:17 gke-standard-cluster-2-pool-1-6ea9f13a-moqf 894 <142>1 2020-10-13T01:21:16.976Z stream-logfwd20-156653024-10121421-eq28-harness-16kn logforwarder - panwlogs - 1,​2020-10-13T01:21:10.000000Z,​007051000113358,​AUTH,​Unknown,​10.0,​2020-10-13T01:21:01.000000Z,​vsys1,​::11e:a8c0:ffff:0,​paloaltonetwork\xxxxx,​paloaltonetwork\xxxxx,​Authentication object4,​Captive Portal,​16777216,​-1295066367845728256,​xxxxx,​rs-logging,​deny-attackers,​www.this.is.another.wannabe.long.url.com/and/it/is/getting/there/by/adding/some/junk/at/the/end/of/the/url/dsakjhfskdjhfksjdhfkhk235hk2jh2kjhkhk23jhk5jh2435kjh45k3jh5k3j4h5k3h45kjh34kj5hkjhkj34hk5jh34k5jhk3j4h5k3jh45kjh34k5jhk34jh5kj34h5kjh43kj5hk34jh5k3j4h5k3j4hghhg4j5h3g,​1,​user password failure,​3,​556392,​-9223372036854775808,​0,​0,​0,​0,​,​PA-VM,​1,​0,​,​2020-10-13T01:21:02.391000Z,​src_category_list-2,​src_profile_list-0,​src_model_list-2,​src_vendor_list-2,​src_osfamily_list-2,​src_osversion_list-2,​src_host_list-2,​src_mac_list-0
The following identifies the fields contained by default when you forward logs to a syslog receiver. The fields are identified in the default order that they appear in each log line.

Recommended For You