Traffic log contains multiple commas in link

Traffic log contains multiple commas in link_switches column

1331

Created On 08/10/21 01:22 AM - Last Modified 10/21/25 20:30 PM

Syslog

Traffic Log

SD-WAN

Reporting and Logging

9.1

10.0

10.1

PAN-OS

Symptom

When you open the exported traffic log with using Excel or other applications which separates column with comma, you can see some columns are shifted.
Also if your system is forwarding traffic log via syslog or another method, syslog server will separate forwarded logs with comma, and columns are shifted.

Starting PAN-OS 9.1, SD-WAN feature is supported.
Some of SD-WAN related fields are added into traffic log. link_switches column is added since PAN-OS 9.1.
Link Switches (link_switches) column contains up to four link flap entries, with each entry containing the link name, link tag, link type, physical interface, timestamp, bytes read, bytes written, link health, and link flap cause.
This field it will contain multiple commas and it will be enclosed in curly brackets.

To facilitate the integration with external log parsing systems, the firewall allows you to customize the log format; it also allows you to add custom Key: Value attribute pairs.
Custom message formats can be configured under Device > Server Profiles > Syslog > Syslog Server Profile > Custom Log Format.
Refer Custom Log/Event Format.