Install a syslog server
To get data into your single-instance Splunk Enterprise deployment, you first need to configure a Linux-based syslog server to send your Palo Alto Networks (PAN) syslog messages.
Palo Alto Networks log sizes vary significantly. Each message is typically around 850 bytes. Users typically see one message per connection, whether allowed or denied. A branch office can generate hundreds of MB per day, while a datacenter cluster can generate approximately 250 GB per day.
show session info command within Palo Alto Networks displays how many connections took place since bootup. One way of estimating event volume is to check this number at the same time on subsequent days. Then, calculate the number of connections you typically see per day. When multiplied by the general 850 byte number, you get an approximate expectation for data size.
Alternatively, you can implement the
rsyslog config command. Then, track the size of the files created on disk to determine volume.
See the Palo Alto Networks PAN-OS 8.0 CLI Configuration guide to learn more.
Install a syslog-ng server
Complete the following steps to install a syslog-ng server:
- (Optional) Uninstall rsyslog if it shipped with your deployment:
sudo rpm -e --nodeps rsyslog
- Install syslog-ng using
sudo yum-get install syslog-ng
yumto search the EPEL repo:
sudo yum --enablerepo=epel install syslog-ng
- (Optional) Install the
syslog-ng-libdbimodule to prevent a warning message from appearing each time syslog-ng starts:
sudo yum install --enablerepo=epel syslog-ng-libdbi
- Once you complete the installation, start syslog-ng:
sudo systemctl start syslog-ng.service sudo systemctl enable syslog-ng.service
- Verify that syslog-ng is running by checking for a pid:
Configure a syslog-ng server to send Palo Alto Networks data to your Splunk Enterprise deployment
This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8