Hello All, We are unable to get the Palo Alto Add-on and App to parse the incoming syslog traffic correctly. The environment we are in prevents us from setting up the syslog-ng.conf exactly as the instructions have listed. We are trying to see if the modification that we have to make is causing the issues with the Add-on and App. The following will show what the instructions call for in the inputs and outputs; while I'll provide what we would have in place. Palo Alto Instructions: Under "Destinations" specify a .log file destination: destination d_udp514 { file("/YOURPATH/udp514.log" template("${MSG}\n")); }; Our Destinations: destination d_5400-A058-PaloAlto { file("/var/log/syslog-ng/PaloAlto.5400-A058.$YEAR.$MONTH.$DAY.log" owner("root") group("root") perm(0644)); }; destination d_5400-B170-PaloAlto { file("/var/log/syslog-ng/PaloAlto.5400-B170.$YEAR.$MONTH.$DAY.log" owner("root") group("root") perm(0644)); }; destination d_5400-PA220-PaloAlto { file("/var/log/syslog-ng/PaloAlto.5400-PA220.$YEAR.$MONTH.$DAY.log" owner("root") group("root") perm(0644)); }; ********************************* Palo Alto Instructions: Create or modify /opt/splunkforwarder/etc/system/local/inputs.conf and add a monitoring stanza: [monitor:///YOURPATH/udp514.log] sourcetype = pan:log Our inputs (using HF instead of UF): [monitor:///var/log/syslog-ng/PaloAlto.5400-A058.$YEAR.$MONTH.$DAY.log] sourcetype = pan:log *** Did not work, so used below *** [monitor:///var/log/syslog-ng()/PaloAlto*.log] sourcetype = pan:log
... View more
