Configure Syslog Monitoring (SCM)

1. Log in to Strata Cloud Manager.
2. Select ManageConfigurationNGFW and Prisma AccessObjectsLog ForwardingSyslog Server ProfileConfigurationNGFW and Prisma AccessObjectsLog ForwardingSyslog Server Profile and select the Configuration Scope where you want to create the Syslog server profile.

   You can select a folder or firewall from your Folders or select Snippets to configure the Syslog server profile in a snippet.
3. Add Syslog.
4. Configure the Syslog server profile.

   1. Enter a descriptive Name.
   2. Add a syslog server.

      Multiple syslog servers might be added to a single Syslog server profile.

      • Name—Unique name for the syslog server.
      • Syslog Server—IP address or fully qualified domain name (FQDN) of the syslog server.
        If you configure an FQDN and use UDP transport, if the firewall can’t resolve the FQDN, the firewall uses the existing IP address resolution for the FQDN as the Syslog Server address.
      • Transport—Select TCP or UDP as the protocol for communicating with the syslog server.
      • Port—The port number on which to send syslog messages (default is UDP on port 514); you must use the same port number on the firewall and the syslog server.
      • Format—Select the syslog message format to use: BSD (default) or IETF. Traditionally, BSD format is over UDP and IETF format is over TCP.
      • Facility—Select a syslog standard value (default is LOG_USER) to calculate the priority (PRI) field in your syslog server implementation. Select the value that maps to how you use the PRI field to manage your syslog messages.
   3. (Optional) Create a custom log/event format.

      To customize the format of the syslog messages the firewall sends, select the Custom Log Format tab.
   4. Save.
5. Configure syslog forwarding.

   1. Select ManageConfigurationObjectsLog ForwardingLog Forwarding ProfileConfigurationNGFW and Prisma AccessObjectsLog ForwardingLog Forwarding Profile and select the Configuration Scope where you want to create the Log Forwarding profile.

      You can select a folder or firewall from your Folders or select Snippets to configure the Log Forwarding profile in a snippet.
   2. Add Log Forwarding Profile.
   3. Enter a descriptive Name.
   4. Add the profile match list for the Log Forwarding profile.

      A match list profile specifies the log query filter, forwarding destinations, and automatic actions to take. Multiple profile match lists can be added to the same Log Forwarding profile to allow you to add different profile match lists for different log types in the same Log Forwarding profile.

      1. Enter a descriptive Name.
      2. Select the Log Type.
         Only one log type can be added per profile match list.
      3. (Optional) Configure the log query Filter. Default is All Logs.
      4. Add the Syslog Profile you created in the previous step.
      5. Save.
      6. Repeat this step for all the log types that you want to forward to your syslog server.
   5. Save.
6. Modify the log forwarding settings for the policy rule.

   • Security Policy—In the Actions, select Log Settings and select the Log Forwarding profile you created for External Log Forwarding.
   • Decryption—In the Log Settings, select the Log Forwarding profile you created for External Log Forwarding.
   • DoS Protection—Expand the Advanced Settings and select the Log Forwarding profile you created for Log Forwarding.
   • Authentication—In the Log Settings and select the Log Forwarding profile that you created for Log Forwarding.
7. Push Config to push your configuration changes.