Skip to content
ConfigProof

All controls

PAN-SEC-075MediumPAN-OS

System or configuration logs are forwarded nowhere

At a glance

Base severity

Medium

Area

Logging and Integrations

Platform

PAN-OS

Evidence level

Derived0.90

Benchmark reference

Reads the export, not the device

ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.

Why it matters

System and configuration logs are the record of who changed what and when the device misbehaved. Kept only on the firewall, they roll over and are lost with the device, which leaves an incident review without its first witness.

How to fix it

Web interface

The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.

  1. Add a Log Settings match list for this log type that forwards to the central collector or to Panorama.
  2. Forward the high and critical system events, as a minimum, and every configuration change.
  3. Confirm the destination profile it names is the one the collector expects.

Command line

PAN-OS CLI

set shared log-settings system match-list <match-name> send-syslog <profile-name>set shared log-settings config match-list <match-name> send-syslog <profile-name>

An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.

Read it back

show shared log-settings system
Values to fill in2
<match-name>
A name for the match list entry
<profile-name>
Which profile to change. A firewall carries several of each kind.

How to confirm the fix

  • Confirm the log type shows a match list with a destination under Device > Log Settings.
  • Confirm the collector or Panorama receives a test event after the change.

Limits

  • Only the device's own Log Settings are read here; a Panorama template may add forwarding that this file does not carry.
  • An entry whose destinations could not be read ends the check for its log type, so the finding is raised only when every entry was read.

Compliance references

No benchmark recommendation is mapped to this control in this version.

More in Logging and Integrations

See it on your own firewall

One complete analysis of one firewall costs nothing. A card is required and nothing is charged.

Start a free analysis