User-ID Log Fields Pre 8.0.11

User-ID syslog field descriptions for PAN-OS 8.0 through PAN-OS 8.0.10 only.
Format: FUTURE_USER, Receive Time, Serial Number, Sequence Number, Action Flags, Type, Threat/Content Type, FUTURE_USE, Generated Time, Device Group Hierarchy Level 1, Device Group Hierarchy Level 2, Device Group Hierarchy Level 3, Device Group Hierarchy Level 4, Virtual System Name, Device Name, Virtual System ID, Virtual System, Source IP, User, Data Source Name, Event ID, Repeat Count, Time Out Threshold, Source Port, Destination Port, Data Source, Data Source Type, FUTURE_USE, FUTURE_USE, Factor Type, Factor Completion Time, Factor Number
Field Name
Description
Receive Time (receive_time)
Time the log was received at the management plane.
Serial Number (Serial #)
Serial number of the firewall that generated the log.
Sequence Number
Serial number of the firewall that generated the log.
Action Flags
A bit field indicating if the log was forwarded to Panorama.
Type (type)
Specifies type of log; values are traffic, threat, config, system and hip-match.
Threat/Content Type
Subtype of traffic log; values are start, end, drop, and deny
"Start-session started
"End-session ended
"Drop-session dropped before the application is identified and there is no rule that allows the session.
"Deny-session dropped after the application is identified and there is a rule to block or no rule that allows the session.
Generated Time (Generate Time)
The time the log was generated on the dataplane.
Device Group Hierarchy (dg_hier_level_1 to dg_hier_level_4)
A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. The firewall (or virtual system) generating the log includes the identification number of each ancestor in its device group hierarchy. The shared device group (level 0) is not included in this structure.
If the log values are 12, 34, 45, 0, it means that the log was generated by a firewall (or virtual system) that belongs to device group 45, and its ancestors are 34, and 12. To view the device group names that correspond to the value 12, 34 or 45, use one of the following methods:
CLI command in configure mode: show readonly dg-meta-data
API query: /api/?type=op&cmd=<show><dg-hierarchy></dg-hierarchy></show>
Virtual System Name
The name of the virtual system associated with the session; only valid on firewalls enabled for multiple virtual systems.
Device Name
The hostname of the firewall on which the session was logged.
Virtual System ID
A unique identifier for a virtual system on a Palo Alto Networks firewall.
Virtual System
Virtual System associated with the configuration log.
Source IP
Original session source IP address.
User
Identifies the end user.
Data Source Name
User-ID source that sends the IP (Port)-User Mapping.
Event ID
String showing the name of the event.
Repeat Count
Number of sessions with same Source IP, Destination IP, Application, and Subtype seen within 5 seconds; used for ICMP only.
Time Out Threshold (timeout)
Timeout after which the IP/User Mappings are cleared.
Source Port (beginport)
Source port utilized by the session.
Destination Port (endport)
Destination port utilized by the session.
Data Source
Source from which mapping information is collected.
Data Source Type
Mechanism used to identify the IP/User mappings within a data source.
Factor Type
Vendor used to authenticate a user when Multi Factor authentication is present.
Factor Completion Time
Time the authentication was completed.
Factor Number
Indicates the use of primary authentication (1) or additional factors (2, 3).

Related Documentation