Strata Logging Service
Tunnel LEEF Fields
Table of Contents
Expand All
|
Collapse All
Tunnel LEEF Fields
Example Tunnel log in LEEF:
Sep 21 02:13:19 xxx.xx.x.xx 2203 <14>1 2021-09-21T02:13:19.109Z stream-logfwd20-b7167985--09201842-8zwj-harness-cc98 logforwarder - panwlogs - LEEF:2.0|Palo Alto Networks|Next Generation Firewall|10.1|drop||TimeReceived=2021-09-21T02:13:18.000000Z DeviceSN=xxxxxxxxxxxxx cat=gtp SubType=drop ConfigVersion=10.1 devTime=2021-09-21T02:13:03.000000Z src=xxx.xx.x.xx dst= srcPostNAT=xxx.xx.x.xx dstPostNAT=xxx.xx.x.xx Rule=allow-all-employees usrName=paloaltonetwork\xxxxx DestinationUser=paloaltonetwork\xxxxx Application=rlogin VirtualLocation=vsys1 FromZone=untrust ToZone=ethernet4Zone-test1 InboundInterface=ethernet1/1 OutboundInterface=ethernet1/1 LogSetting=rs-logging SessionID=396610 RepeatCount=1 srcPort=20679 dstPort=2619 srcPostNATPort=8544 dstPostNATPort=27147 proto=tcp TunnelEventType=51 MobileSubscriberISDN= AccessPointName= RadioAccessTechnology=11 TunnelMessageType=0 MobileIP= TunnelEndpointID1=0 TunnelEndpointID2=0 TunnelInterface=0 TunnelCauseCode=0 VendorSeverity=Unused MobileCountryCode=0 MobileNetworkCode=0 MobileAreaCode=0 MobileBaseStationCode=0 TunnelEventCode=0 SequenceNo=7003061089432915273 SourceLocation=west-coast DestinationLocation=BR DGHierarchyLevel1=11 DGHierarchyLevel2=0 DGHierarchyLevel3=0 DGHierarchyLevel4=0 VirtualSystemName= DeviceName=xxxxx IMSI=0 IMEI= ParentSessionID=0 ParentStarttime=1970-01-01T00:00:00.000000Z Tunnel=HTTP2-CONNECTION Bytes=7102726800694 srcBytes=58980433922 dstBytes=7043746366772 totalPackets=1632190399 srcPackets=1632190349 dstPackets=50 PacketsDroppedMax=0 PacketsDroppedProtocol=724238337 PacketsDroppedStrict=0 PacketsDroppedTunnel=45 TunnelSessionsCreated=536936689 TunnelSessionsClosed=-1107230720 SessionEndReason=aged-out ActionSource= startTime=1970-01-01T00:00:03.000000Z SessionDuration=-121241600 TunnelInspectionRule= TunnelRemoteUserIP= TunnelRemoteIMSIID=0 RuleUUID=d0658a8e-c749-4b1c-a7dc-3247de1c94e7 DynamicUserGroupName= ContainerID= ContainerNameSpace= ContainerName= SourceEDL= DestinationEDL= SourceDynamicAddressGroup= DestinationDynamicAddressGroup= TimeGeneratedHighResolution=2021-09-21T02:13:03.915000Z NSSAINetworkSliceDifferentiator=0 NSSAINetworkSliceType=0 ProtocolDataUnitsessionID=0 devTimeFormat=YYYY-MM-DD'T'HH:mm:ss.SSSZ
The following table identifies the Tunnel field names that the Log Forwarding app
uses when you forward logs using the LEEF log format.
When you
create a syslog forwarding profile
,
you can optionally create a profile token that the Log
Forwarding app uses when it sends logs to the syslog server. If you configure a profile token,
it appears in the log line immediately after the log type information (for example,
TRAFFIC
, THREAT
,
HIPMATCH
, and so forth). The token will appear on
a parameter called profileToken
.
LEEF Name
|
Query Name
|
Field Type
|
|---|---|---|