How to Export and Review Palo Alto and FortiGate Firewall Logs
Summary
A practical guide to forwarding Palo Alto and FortiGate logs to a Linux rsyslog collector or downloading existing logs, with configuration steps, review patterns, and troubleshooting advice.
Key points
- Check logging policies first: PAN-OS default rules and FortiGate implicit-deny logging may not record denied traffic by default.
- Forward logs to a Linux collector with rsyslog; configure PAN-OS log forwarding or FortiGate syslog settings and attach or commit the relevant profiles.
- Restrict UDP 514 access to the firewall’s management or logging interface and the collector.
- For historical logs, FortiGate supports raw-log downloads through its GUI; PAN-OS history is usually available through Panorama, Strata Logging Service, or a SIEM.
- Review repeated outbound connections, unusually high outbound data, port scanning, threat-log hits, and unusual firewall admin logins or configuration changes.
- Troubleshoot missing logs by checking policies, network access, syslog settings, and commits; consider TCP syslog if UDP message-size limits truncate long lines.
Article Details
- Defense Focus
- Collect and retain firewall traffic, threat, administrative, and configuration logs so they can be analyzed for suspicious activity.
- Detection Methods
- Look for repeated outbound sessions to the same rare external IP at regular intervals as possible command-and-control beaconing.
- Compare outbound data volumes and flag an internal host sending substantially more bytes than usual.
- Look for one source contacting many destination ports within a short period as possible scanning.
- Review IPS, antivirus, spyware, and URL-filtering detections, including activity that followed the alert.
- Review firewall admin logins from unusual IPs and configuration changes at unusual times.
- Data Sources
- PAN-OS Traffic, Threat, System, and Config logs
- FortiGate Forward Traffic, Security Events, System Events, and event logs
- Firewall syslog records collected in /var/log/firewall/fw.log
- Historical logs held by Panorama, Strata Logging Service, FortiAnalyzer, or FortiCloud
- Rule Types
- Syslog forwarding and file-output configuration
- Detection rules for command-and-control over common protocols, exfiltration over alternative channels, and network scanning
- Platforms
- PAN-OS
- FortiGate
- Panorama
- Strata Logging Service
- FortiAnalyzer
- FortiCloud
- FortiGate Cloud
- Prime Core
- LogTotal
- rsyslog
- Defensive Actions
- Enable logging on PAN-OS default rules and the FortiGate implicit deny policy when denied traffic needs to be recorded.
- Configure logging per FortiGate policy and attach a log-forwarding profile to PAN-OS security rules.
- Forward Traffic and Threat logs, as well as System and Config logs, to a syslog collector.
- Restrict access to UDP 514 on the collector to the firewall's management or logging interface.
- Check each network and configuration hop if the collector receives no logs; use a packet capture to verify UDP 514 traffic.
- Use TCP syslog if long log lines are truncated by UDP message-size limits.
- Forward logs off diskless FortiGate models because memory-only logs are lost on reboot; use centralized history sources where available.
- Correct firewall time settings and NTP synchronization when timestamps do not align with other sources.
- Sanitize log files before uploading them for review.
MITRE ATT&CK
T1046 · Network Service DiscoveryThe article identifies detection rules for network scanning, including many destination ports contacted by one source in a short window.T1048 · Exfiltration Over Alternative ProtocolThe article identifies detection rules for exfiltration over alternative channels in firewall logs.T1071 · Application Layer ProtocolThe article identifies detection rules for command-and-control over common protocols in firewall logs.
Vendors
Products
FortiAnalyzerIf you run Panorama, Strata Logging Service, FortiAnalyzer or FortiCloud, they almost certainly hold more history than the firewall.FortiCloudIf you run Panorama, Strata Logging Service, FortiAnalyzer or FortiCloud, they almost certainly hold more history than the firewall.FortiGate CloudNote: Direct GUI downloads have a hard cap (typically 400,000 log entries on the device, or 2,000–40,000 via FortiGate Cloud).Fortinet FortiGateThe dependable way to get Palo Alto or FortiGate logs into a file you can analyze is syslog.LogTotalUpload, sanitize and review in LogTotalPAN-OSOn PAN-OS, the practical source of history is usually Panorama, Strata Logging Service or your SIEM.PanoramaOn PAN-OS, the practical source of history is usually Panorama, Strata Logging Service or your SIEM.Prime CoreTheir logs answer “where did that host talk to?” and “who logged into the firewall at 3 a.m.?” Prime Core has 2093 detection rules for firewall logs, mapped to 554 MITRE ATT&CK techniques.Strata Logging ServiceOn PAN-OS, the practical source of history is usually Panorama, Strata Logging Service or your SIEM.
Tools
rsyslogForward the firewall’s logs to a small Linux collector running rsyslog, and export the collector’s file.tcpdumpCollector receives nothing Network ACL, wrong port or protocol, rsyslog not listening, or (PAN-OS) profile not attached or not committed Check each hop; tcpdump -n udp port 514 on the collector