UDP Syslog 转发不起作用

• 防火墙未与通过UDP配置的syslog服务器进行通信。
• 在packet capture(数据包捕获-pcap)/tcpdump 中没有看到流量。
• 在“外部转发统计”下运行“debug log-receiver statistics”命令时，Syslog 计数为 0。

FW> debug log-receiver statistics
Logging statistics
------------------------------ -----------
Log incoming rate:             64/sec
Log written rate:              58/sec
Corrupted packets:             0
Corrupted URL packets:         0
Corrupted HTTP HDR packets:    0
Corrupted HTTP HDR Insert packets: 0
...
Netflow incoming count:        0
Log Forward count:             0
Log Forward discarded (queue full) count: 0
Log Forward discarded (send error) count: 0
Total logs not written due to disk unavailability: 0
----------------------------------------

External Forwarding stats:
      Type  Enqueue Count     Send Count     Drop Count    Queue Depth     Send Rate(last 1min)
    syslog              0              0              0              0                        0
      snmp              0              0              0              0                        0
     email              0              0              0              0                        0
       raw              0              0              0              0                        0
      http              0              0              0              0                        0
   autotag              0              0              0              0                        0
quarantine              0              0              0              0                        0

• 以下错误，在 logrcvr.log 中注意到消息

var/log/pan/logrcvr.log.old
2024-04-23 05:44:49.559 -0700 Error:  pan_log_query_parse_nolock(pan_log_query.c:13191): query: (All LogsFW)
2024-04-23 05:44:49.559 -0700 Error:  _query_grp_mgr_add_lq_query_str(pan_query_grp.c:490): Error parsing query:(All LogsFW) in grp_mgr:query-fsm-grp-mgr-0
2024-04-23 05:44:49.559 -0700 Error:  pan_query_grp_mgr_add_query_str(pan_query_grp.c:599): Error adding lq query to query_grp_mgr:query-fsm-grp-mgr-0
2024-04-23 05:44:49.559 -0700 Error:  pan_init_fsm_2(pan_log_handler.c:9499): Failed to add filter (All LogsFW) to query_grp_mgr
2024-04-23 05:44:49.560 -0700 Error:  _logrcvr_fsm_init(pan_log_receiver.c:21758): FSM init failed. Log forwarding will not work
2024-04-23 05:44:49.560 -0700 after init FSM in _logrcvr_fsm_init(): fsm: (nil), grp_mgr: (nil), match_arr: (nil)
2024-04-23 05:44:49.560 -0700 Error:  pan_log_config_phase1(pan_log_receiver.c:15326): could not initialize FSM, log forwarding will not work!

• 配置了多个 Syslog 服务器配置文件

• “FW-DMZ-SYSLOG”配置文件用于将日志转发到相关的syslog服务器。
• 尽管与配置文件“FW-DMZ-SYSLOG”相关的日志设置和过滤器正确，但日志转发仍然不起作用。

<shared><log-settings><profiles><entry name="LogForward"><match-list><entry name="LogForward-traffic"><send-syslog><member>: FW-DMZ-SYSLOG
<shared><log-settings><profiles><entry name="LogForward"><match-list><entry name="LogForward-traffic"><log-type>: traffic
<shared><log-settings><profiles><entry name="LogForward"><match-list><entry name="LogForward-traffic"><filter>: All Logs
<shared><log-settings><profiles><entry name="LogForward"><match-list><entry name="LogForward-traffic"><send-to-panorama>: no
<shared><log-settings><profiles><entry name="LogForward"><match-list><entry name="LogForward-traffic"><quarantine>: no

• 帕诺斯
• 日志转发
• 系统日志

• 所有日志转发都经过 FSM（有限状态机）来确定是否应该进行转发。FSM 评估日志转发设置中定义的所有过滤器。
• 如果任何过滤器无效，则 FSM 不会初始化，因此不会执行任何日志转发。
• 运行配置包含无效的日志转发配置。 “FW-SYSLOG”的过滤器不正确。应该是“所有日志”，而不是“所有 LogsFW”。

<shared><log-settings><system><match-list><entry name="FW-SYSLOG"><send-syslog><member>: FW-SYSLOG
<shared><log-settings><system><match-list><entry name="FW-SYSLOG"><filter>: All LogsFW
<shared><log-settings><system><match-list><entry name="SYSTEM-SYSLOG"><send-syslog><member>: FW-DMZ-SYSLOG
<shared><log-settings><system><match-list><entry name="SYSTEM-SYSLOG"><filter>: All Logs

1. 要编辑过滤器类型，请转到“日志设置”->“系统”->单击“名称”。这将打开一个新窗口。
2. 在“日志设置 - 系统”窗口下，转到“过滤器”并选择“所有日志”