IP-Tag Log Fields

You can view IP-tag log information using the syslog.
Format: FUTURE_USE , Receive Time, Serial, Type, Threat/Content Type, FUTURE_USE, Generate Time, Virtual System, Source IP, Tag Name , Event ID, Repeat Count , Timeout, Data Source Name, Data Source Type, Data Source Subtype, Sequence Number, Action Flags, DG Hierarchy Level 1 , DG Hierarchy Level 2, DG Hierarchy Level 3, DG Hierarchy Level 4, Virtual System Name, Device Name, Virtual System ID
Field Name
Description
Receive Time (receive_time or cef-formatted-receive_time)
Time the log was received at the management plane.
Serial Number (serial)
Serial number of the firewall that generated the log.
Type (type)
The type of log; IPTAG.
Threat/Content Type (subtype)
Subtype of HIP match log; unused.
Generated Time (time_generated or cef-formatted-time_generated)
Time the log was generated on the dataplane.
Virtual System (vsys)
Virtual System associated with the HIP match log.
Source IP (src)
IP address of the source user.
Tag Name (tag_name)
The tag mapped to the source IP address.
Event ID (event_id)
String showing the name of the event.
Repeat Count (repeatcnt)
Number of sessions with same Source IP, Destination IP, Application, and Subtype seen within 5 seconds.
Timeout (timeout)The amount of time before the IP-to-tag mapping expires for the source IP address.
Data Source Name (datasourcename)Name of the source from which mapping information is collected.
Data Source Type (datasource_type)Source from which mapping information is collected.
Data Source Subtype (datasource_subtype)Mechanism used to identify the IP/User mappings within a data source.
Sequence Number (seqno)
A 64-bit log entry identifier incremented sequentially. Each log type has a unique number space.
Action Flags (actionflags)
A bit field indicating if the log was forwarded to Panorama.
Device Group Hierarchy (dg_hier_level_1 to dg_hier_level_4)
A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. The firewall (or virtual system) generating the log includes the identification number of each ancestor in its device group hierarchy. The shared device group (level 0) is not included in this structure.
If the log values are 12, 34, 45, 0, it means that the log was generated by a firewall (or virtual system) that belongs to device group 45, and its ancestors are 34, and 12. To view the device group names that correspond to the value 12, 34 or 45, use one of the following methods:
CLI command in configure mode: show readonlydg-meta-data
API query:
/api/?type=op&cmd=<show><dg-hierarchy></dg-hierarchy></show>
Code copied to clipboard
Unable to copy due to lack of browser support.
Virtual System Name (vsys_name)
The name of the virtual system associated with the session; only valid on firewalls enabled for multiple virtual systems.
Device Name (device_name)
The hostname of the firewall on which the session was logged.
Virtual System ID (vsys_id)
A unique identifier for a virtual system on a Palo Alto Networks firewall.

Related Documentation