108
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Enable
Log
Forwarding
to
Panorama
Manage
Log
Collection
Enable
Log
Forwarding
to
Panorama
Log
Forwarding
to
Panorama:
Workflows
by
Log
Type
The
workflow
to
depends
on
the
log
type
and
whether
the
firewalls
will
also
forward
logs
directly
to
external
services
or
forward
logs
from
Panorama
and
then
to
external
services:
If
the
firewalls
will
directly
forward
Syslog
messages,
notifications,
or
SNMP
traps
to
external
services,
use
the
template
Device > Server Profiles
options
to
define
a
server
profile
for
each
external
service.
If
the
firewalls
will
only
forward
logs
to
Panorama
or
a
Log
Collector,
template
server
profiles
are
unnecessary.
If
Panorama
will
forward
the
logs
to
external
services,
define
server
profiles
using
the
Panorama > Server Profiles
options
when
you
(For
details
about
these
options,
see
Configure
each
log
type
for
forwarding.
For
each
type,
you
can
specify
whether
to
forward
directly
to
external
services
in
addition
to
Panorama.
When
forwarding
to
Panorama
is
enabled
in
a
distributed
log
collection
deployment,
the
log
forwarding
preference
list
determines
to
which
Log
Collectors
the
firewalls
send
logs.
While
you
can
configure
log
forwarding
manually
on
each
firewall
(refer
to
the
),
use
device
groups
and
templates
on
Panorama
for
a
more
streamlined
workflow.
The
specific
Panorama
workflow
to
enable
log
forwarding
depends
on
the
log
types:
–
Traffic,
threat,
and
WildFire
logs—Use
device
groups
to
create
a
log
forwarding
profile
(
Objects > Log
Forwarding
)
for
forwarding
to
Panorama
and
(if
required)
to
an
external
service.
For
example,
if
you
will
forward
logs
to
a
Syslog
server,
create
a
Syslog
server
profile
using
templates
(
Device > Server
Profiles > Syslog
).
The
log
forwarding
profile
uses
the
Syslog
server
profile
to
access
the
server.
The
following
table
describes
these
logs
and
associated
forwarding
requirements.
–
System,
config,
and
HIP
match
logs—Configure
a
template
and
select
the
Panorama
check
box
to
enable
forwarding
to
Panorama
in
the
corresponding
Device > Log Settings
tab.
You
can
also
forward
these
logs
to
external
services.
For
example,
to
forward
logs
directly
to
traditional
Syslog
servers
or
to
Security
Information
and
Event
Management
(SIEM)
servers
(for
example,
Splunk,
Arcsight,
or
Log
type
Description
and
Forwarding
Requirements
Traffic
Logs
To
forward
traffic
logs,
set
up
a
log
forwarding
profile
and
add
it
to
the
security
policies
for
which
you
want
forwarding
to
occur.
Firewalls
only
log
and
forward
traffic
that
matches
a
specific
rule.
Threat
Logs
(includes
URL
Filtering
Logs,
and
Data
Filtering
Logs)
To
forward
threat
logs,
create
a
log
forwarding
profile
that
specifies
which
severity
levels
you
want
to
forward
and
then
add
it
to
the
security
policies
for
which
you
want
forwarding
to
occur.
You
must
also
attach
a
security
profile
(Antivirus,
Anti
‐
spyware,
Vulnerability,
URL
Filtering,
File
Blocking,
Data
Filtering,
or
DoS
Protection)
to
the
security
policy.
Firewalls
only
create
and
forward
a
threat
log
entry
if
the
associated
traffic
matches
a
security
profile.
WildFire
Logs
To
forward
WildFire
logs
(files
submitted
to
WildFire
for
analysis),
specify
whether
to
forward
results
with
a
verdict
of
benign
or
malicious
.
