# Palo Alto Firewall Syslog Filter

##### <span style="color: rgb(53, 152, 219);">**Introduction**</span>

<span style="color: rgb(0, 0, 0);">This guide outlines how to configure **Syslog filters** on Palo Alto Networks firewalls to control which logs are sent to external Syslog servers. Proper filtering reduces noise, focuses on relevant events, and improves SIEM performance.</span>

##### <span style="color: rgb(53, 152, 219);">**Syslog Overview**</span>

<span style="color: rgb(0, 0, 0);">Syslog is a protocol used to send logs from network devices to centralized logging systems. Palo Alto firewalls support syslog forwarding for various log types: **traffic**, **threat**, **system**, and **configuration**.</span>

##### <span style="color: rgb(53, 152, 219);">**Components Involved**</span>

<div class="_tableWrapper_16hzy_14 group flex w-fit flex-col-reverse" id="bkmrk-component-descriptio-1" tabindex="-1"><table border="1" class="w-fit min-w-(--thread-content-width)" data-end="1658" data-start="1224" style="width: 108.69%; border-collapse: collapse; border-width: 1px; height: 160px;"><thead data-end="1310" data-start="1224"><tr data-end="1310" data-start="1224"><th data-col-size="sm" data-end="1249" data-start="1224" style="width: 28.1969%; border-width: 1px;"><span style="color: rgb(0, 0, 0);">Component</span>

</th><th data-col-size="md" data-end="1310" data-start="1249" style="width: 71.8058%; border-width: 1px;"><span style="color: rgb(0, 0, 0);">Description</span>

</th></tr></thead><tbody data-end="1658" data-start="1398"><tr data-end="1484" data-start="1398"><td data-col-size="sm" data-end="1423" data-start="1398" style="width: 28.1969%; border-width: 1px;"><span style="color: rgb(0, 0, 0);">Syslog Server Profile</span>

</td><td data-col-size="md" data-end="1484" data-start="1423" style="width: 71.8058%; border-width: 1px;"><span style="color: rgb(0, 0, 0);">Defines the destination server and syslog transport type</span>

</td></tr><tr data-end="1571" data-start="1485"><td data-col-size="sm" data-end="1510" data-start="1485" style="width: 28.1969%; border-width: 1px;"><span style="color: rgb(0, 0, 0);">Log Forwarding Profile</span>

</td><td data-col-size="md" data-end="1571" data-start="1510" style="width: 71.8058%; border-width: 1px;"><span style="color: rgb(0, 0, 0);">Specifies what logs to forward and to whom</span>

</td></tr><tr data-end="1658" data-start="1572"><td data-col-size="sm" data-end="1597" data-start="1572" style="width: 28.1969%; border-width: 1px;"><span style="color: rgb(0, 0, 0);">Security Policy</span>

</td><td data-col-size="md" data-end="1658" data-start="1597" style="width: 71.8058%; border-width: 1px;"><span style="color: rgb(0, 0, 0);">Determines when logs are generated and which are forwarded</span>

</td></tr></tbody></table>

</div>##### **<span style="color: rgb(53, 152, 219);">Configuration Steps</span>**

##### **<span style="color: rgb(53, 152, 219);">1. Create Syslog Server Profile</span>**

##### <span style="color: rgb(0, 0, 0);"> Navigate to: **Device** &gt; **Server Profiles** &gt; **Syslog**</span>

##### **Steps:**

1. <span style="color: rgb(0, 0, 0);">Click **Add** to create a new profile.</span>  
    [![2025-06-19_11-20.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/scaled-1680-/UVKt7zpsTvW9bCUI-2025-06-19-11-20.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/UVKt7zpsTvW9bCUI-2025-06-19-11-20.png)
2. <span style="color: rgb(0, 0, 0);">Enter a </span>**<span style="color: rgb(0, 0, 0);">Name (e.g., AQUILA-Syslog-Filter).</span> [![syslog name.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/scaled-1680-/KZGuGzwbBSly05zw-syslog-name.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/KZGuGzwbBSly05zw-syslog-name.png)**
3. <span style="color: rgb(0, 0, 0);">Under **Syslog Server**, click **Add** and enter:</span>
    
    
    - <span style="color: rgb(0, 0, 0);">**Name**: e.g., AQUILA-Server</span>
    - <span style="color: rgb(0, 0, 0);">**Server**: IP or hostname of your syslog server(log collecttor IP)</span>
    - <span style="color: rgb(0, 0, 0);">**Transport**: UDP or TCP</span>
    - <span style="color: rgb(0, 0, 0);">**Port**: Default is 514 (UDP)</span>
    - <span style="color: rgb(0, 0, 0);">**Facility**: e.g., local4</span>
    - <span style="color: rgb(0, 0, 0);">**Format**: BSD</span>  
        [![2025-06-19_11-33.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/scaled-1680-/jm5IZn8oPyzwM6iS-2025-06-19-11-33.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/jm5IZn8oPyzwM6iS-2025-06-19-11-33.png)
4. <span style="color: rgb(0, 0, 0);">Add a **Filter** to specify:</span>
    
    
    - <span style="color: rgb(0, 0, 0);">**Log Type**: Threat</span>
    - <span style="color: rgb(0, 0, 0);">**Severity**: High</span>  
        [![levels.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/scaled-1680-/NFrEro1pXoJSroAi-levels.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/NFrEro1pXoJSroAi-levels.png)
5. <span style="color: rgb(0, 0, 0);">Click </span>**<span style="color: rgb(0, 0, 0);">OK</span>**

##### <span style="color: rgb(53, 152, 219);">**2. Create Log Forwarding Profile**</span>

<span style="color: rgb(0, 0, 0);">Navigate to: **Objects** &gt; **Log Forwarding**</span>

**[![objects.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/scaled-1680-/LUCzkkk4DwCi2xW7-objects.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/LUCzkkk4DwCi2xW7-objects.png)**

##### **Steps:**

1. <span style="color: rgb(0, 0, 0);">Click **Add** to create a new log forwarding profile.</span>  
    [![add.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/scaled-1680-/RBWMVx9jxKAdvLnd-add.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/RBWMVx9jxKAdvLnd-add.png)
2. <span style="color: rgb(0, 0, 0);">Name it (example: syslog) </span>
3. <span style="color: rgb(0, 0, 0);">Under **Log Type**, click **Add** and configure:</span>  
    [![syslog .png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/scaled-1680-/TsTqOna0GsjIzAsU-syslog.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/TsTqOna0GsjIzAsU-syslog.png)
    
    
    - **Log Type**: Select Threat  
        [![traffic.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/scaled-1680-/cyWcOslLjexb9bjy-traffic.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/cyWcOslLjexb9bjy-traffic.png)
    - **Filter**: severity eq high
    - **Forward Method**: Select the Syslog Server Profile you created, click **Add** then select the one you **created**
4. <span style="color: rgb(0, 0, 0);">Click </span>**<span style="color: rgb(0, 0, 0);">OK</span>  
    [![methof.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/scaled-1680-/NITyrphhyaMsouws-methof.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/NITyrphhyaMsouws-methof.png)  
    [![okay.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/scaled-1680-/o8r1tkpKiqn7aHWT-okay.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/o8r1tkpKiqn7aHWT-okay.png)**

##### <span style="color: rgb(53, 152, 219);">**3. Apply Log Forwarding to Security Policy**</span>

<span style="color: rgb(0, 0, 0);">**Navigate to: Policies &gt; Security**</span>

**[![sections.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/scaled-1680-/w7oQKZI0gBzIvdui-sections.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/w7oQKZI0gBzIvdui-sections.png)**

##### <span style="color: rgb(0, 0, 0);">**Steps:**</span>

1. <span style="color: rgb(0, 0, 0);">Locate and **edit** the security policy you want to apply logging to.</span>
2. <span style="color: rgb(0, 0, 0);">Click the **Actions** tab.</span>
3. <span style="color: rgb(0, 0, 0);">In the **Log Forwarding** field, select the log forwarding profile you created.</span>
4. <span style="color: rgb(0, 0, 0);">(Optional) Enable logging at session start/end.</span>
5. <span style="color: rgb(0, 0, 0);">Click **OK** and then **Commit** your changes.</span>  
    [![fd.png](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/scaled-1680-/QCZiWwBgPTTVKz7a-fd.png)](https://cytechint-docs-bookstack.s3.amazonaws.com/uploads/images/gallery/2025-06/QCZiWwBgPTTVKz7a-fd.png)

##### <span style="color: rgb(0, 0, 0);"><span class="TextRun SCXW71272603 BCX0" data-contrast="auto" lang="EN-US" xml:lang="EN-US"><span class="NormalTextRun SCXW71272603 BCX0"> </span><span style="color: rgb(186, 55, 42);">**<span class="NormalTextRun SCXW71272603 BCX0">Please provide the following information to </span><span class="NormalTextRun SpellingErrorV2Themed SCXW71272603 BCX0">CyTech</span><span class="NormalTextRun SCXW71272603 BCX0">: </span>**</span></span><span style="color: rgb(186, 55, 42);">**<span class="EOP SCXW71272603 BCX0" data-ccp-props="{}"> </span>**</span></span>

<span data-teams="true" style="color: rgb(0, 0, 0);">Requirements:Collect logs via syslog over UDP or TCP</span>

<span style="color: rgb(0, 0, 0);"><span data-teams="true"> </span><span data-teams="true">\***Syslog Host**-&gt; Syslog Collector IP address where the Elastic-Agent is installed.  
 \***Syslog Port**-&gt; Port Number (Please identify if TCP or UDP)</span></span>

<span style="color: rgb(0, 0, 0);">*Reference Links:* </span>

- *<span style="color: rgb(132, 63, 161);">[https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/configure-syslog-monitoring](https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/configure-syslog-monitoring "Palo alto")</span>*
- *<span style="color: rgb(132, 63, 161);">[https://www.youtube.com/watch?v=ftR3DU2MtjY&amp;t=137s](https://www.youtube.com/watch?v=ftR3DU2MtjY&t=137s "syslog system configure")</span>*

*If you need further assistance, kindly contact our support at* <span style="color: rgb(53, 152, 219);">***support@cytechint.com***</span> *for prompt assistance and guidance.*