Config Log Fields

FUTURE_USE, Receive Time, Serial Number, Type, Subtype, FUTURE_USE, Generated Time, Host, Virtual System, Command, Admin, Client, Result, Configuration Path, Before Change Detail, After Change Detail, Sequence Number, Action Flags, Device Group Hierarchy Level 1, Device Group Hierarchy Level 2, Device Group Hierarchy Level 3, Device Group Hierarchy Level 4, Virtual System Name, Device Name, Device Group, Audit Comment
Field Name
Receive Time (receive_time or cef-formatted-receive_time)
Time the log was received at the management plane.
Serial Number (serial)
Serial number of the device that generated the log.
Type (type)
Specifies the type of log; value is CONFIG.
Threat/Content Type (subtype)
Subtype of the configuration log; unused.
Generated Time (time_generated or cef-formatted-time_generated)
Time the log was generated on the dataplane.
Host (host)
Hostname or IP address of the client machine
Virtual System (vsys)
Virtual System associated with the configuration log
Command (cmd)
Command performed by the Admin; values are add, clone, commit, delete, edit, move, rename, set.
Admin (admin)
Username of the Administrator performing the configuration
Client (client)
Client used by the Administrator; values are Web and CLI
Result (result)
Result of the configuration action; values are Submitted, Succeeded, Failed, and Unauthorized
Configuration Path (path)
The path of the configuration command issued; up to 512 bytes in length
Before Change Detail (before_change_detail)
This field is in custom logs only; it is not in the default format.
It contains the full xpath before the configuration change.
After Change Detail (after_change_detail)
This field is in custom logs only; it is not in the default format.
It contains the full xpath after the configuration change.
Sequence Number (seqno)
A 64bit log entry identifier incremented sequentially; each log type has a unique number space.
Action Flags (actionflags)
A bit field indicating if the log was forwarded to Panorama.
Device Group Hierarchy (dg_hier_level_1 to dg_hier_level_4)
A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. The firewall (or virtual system) generating the log includes the identification number of each ancestor in its device group hierarchy. The shared device group (level 0) is not included in this structure.
If the log values are 12, 34, 45, 0, it means that the log was generated by a firewall (or virtual system) that belongs to device group 45, and its ancestors are 34, and 12. To view the device group names that correspond to the value 12, 34 or 45, use one of the following methods:
CLI command in configure mode:
show readonly dg-meta-data
API query:
Virtual System Name (vsys_name)
The name of the virtual system associated with the session; only valid on firewalls enabled for multiple virtual systems.
Device Name (device_name)
The hostname of the firewall on which the session was logged.
Device Group (dg_id)
The device group the firewall belongs to if managed by a Panorama™ management server.
Audit Comment (comment)
The audit comment entered in a policy rule configuration change.

Recommended For You