©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
109
Manage
Log
Collection
Enable
Log
Forwarding
to
Panorama
Qradar)
for
archiving,
use
a
template
to
define
a
Syslog
server
profile
(
Device > Server Profiles >
Syslog
).
The
following
table
describes
these
logs
and
associated
forwarding
requirements.
Configure
Log
Forwarding
to
Panorama
For
details
about
the
options
and
requirements
associated
with
forwarding
logs
to
Panorama,
see
Log
type
Description
and
Forwarding
Requirements
System
Logs
System
logs
show
system
events
such
as
HA
failures,
link
status
changes,
and
administrative
access
to
the
firewall.
For
each
severity
level
for
which
you
want
to
forward
logs,
select
forwarding
to
Panorama
and
(if
required)
to
an
server,
SNMP
trap
server,
or
Syslog
server.
Config
Logs
Configuration
logs
record
changes
to
the
firewall
configurations.
To
enable
forwarding
of
config
logs,
you
must
select
forwarding
to
Panorama
and
(if
required)
to
an
server,
SNMP
trap
server,
or
Syslog
server.
HIP
Match
Logs
To
enable
forwarding
of
Host
Information
Profile
(HIP)
match
logs,
you
must
select
forwarding
to
Panorama
and
(if
required)
to
an
server,
SNMP
trap
server,
or
Syslog
server.
PAN
‐
OS
uses
HIP
match
logs
to
compile
information
on
GlobalProtect
clients.
PAN
‐
OS
generates
a
HIP
match
log
when
a
firewall
sends
a
HIP
report
and
a
HIP
profile
specifies
HIP
objects
(for
example,
OS
version,
patch
level,
disk
encryption,
and
antivirus
version)
that
match
on
the
firewall.
