What happens when an HTTPS log forwarding server disconnects from Strata Logging Service?

What happens when an HTTPS log forwarding server disconnects from Strata Logging Service?

416
Created On 07/30/25 01:00 AM - Last Modified 12/30/25 04:00 AM


Question


What happens to logs when an external HTTPS server disconnects from Strata Logging Service?



Environment


  • Strata Logging Service
  • Log Forwarding feature enabled
  • External HTTPS log forwarding server


Answer


  1. When Strata Logging Service cannot reach an external customer-owned HTTPS server, a retry mechanism is activated.
  2. The retry mechanism is designed for unlimited retries until a successful response is received.
  3. When sending logs, a batch of 10,000 logs is sent in a single request, and SLS expects a single 200 HTTP response to confirm successful delivery.
  4.  If the successful response is not received, the batch of 10,000 logs is sent again.
  5. In the event of a server disconnection or lack of successful response, logs will be queued for up to 7 days before they are dropped by SLS.
  6. This means that when a server is disconnected or not responding with a 200/success, logs will continue to retry for up to 7 days.


Additional Information


  • An email alert can be configured to  send  status notification when Strata Logging Service is unable to connect to the HTTPS receiver. 
  • Once configured, the notifications are sent at least once every 60 minutes until the service restores connectivity.
  • Refer to Forward Logs To An HTTPS Server 


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000kA6BKAU&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail