Panos.Syslog.Traffic

Fields for traffic logs.

Fields

action :: Traffic -> Bytes

Action taken for the session; possible values are:

• allow: session was allowed by policy
• deny: session was denied by policy
• drop: session was dropped silently
• drop ICMP: session was silently dropped with an ICMP unreachable message to the host or application
• reset both: session was terminated and a TCP reset is sent to both the sides of the connection
• reset client: session was terminated and a TCP reset is sent to the client
• reset server: session was terminated and a TCP reset is sent to the server

application :: Traffic -> Bytes

Application associated with the session.

bytes :: Traffic -> Word64

Number of total bytes (transmit and receive) for the session.

bytesReceived :: Traffic -> Word64

Number of bytes in the server-to-client direction of the session.

bytesSent :: Traffic -> Word64

Number of bytes in the client-to-server direction of the session.

destinationAddress :: Traffic -> IP

Original session destination IP address.

destinationCountry :: Traffic -> Bytes

Destination country or Internal region for private addresses. Maximum length is 32 bytes.

destinationPort :: Traffic -> Word16

Destination port utilized by the session.

destinationUser :: Traffic -> Bytes

Username of the user to which the session was destined.

destinationZone :: Traffic -> Bytes

Zone the session was destined to.

deviceName :: Traffic -> Bytes

The hostname of the firewall on which the session was logged.

elapsedTime :: Traffic -> Word64

Elapsed time of the session.

inboundInterface :: Traffic -> Bytes

Interface that the session was sourced from.

ipProtocol :: Traffic -> Bytes

IP protocol associated with the session.

logAction :: Traffic -> Bytes

Log Forwarding Profile that was applied to the session.

natDestinationIp :: Traffic -> IP

If Destination NAT performed, the post-NAT Destination IP address.

natDestinationPort :: Traffic -> Word16

Post-NAT destination port.

natSourceIp :: Traffic -> IP

If Source NAT performed, the post-NAT Source IP address.

natSourcePort :: Traffic -> Word16

Post-NAT source port.

outboundInterface :: Traffic -> Bytes

Interface that the session was destined to.

packets :: Traffic -> Word64

Number of total packets (transmit and receive) for the session.

packetsReceived :: Traffic -> Word64

Number of server-to-client packets for the session.

packetsSent :: Traffic -> Word64

Number of client-to-server packets for the session.

ruleName :: Traffic -> Bytes

Name of the rule that the session matched.

sequenceNumber :: Traffic -> Word64

A 64-bit log entry identifier incremented sequentially; each log type has a unique number space.

serialNumber :: Traffic -> Bytes

Serial number of the firewall that generated the log. These occassionally contain non-numeric characters, so do not attempt to parse this as a decimal number.

sessionEndReason :: Traffic -> Bytes

The reason a session terminated.

sourceAddress :: Traffic -> IP

Original session source IP address.

sourceCountry :: Traffic -> Bytes

Source country or Internal region for private addresses; maximum length is 32 bytes.

sourcePort :: Traffic -> Word16

Source port utilized by the session.

sourceUser :: Traffic -> Bytes

Username of the user who initiated the session.

sourceZone :: Traffic -> Bytes

Zone the session was sourced from.

subtype :: Traffic -> Bytes

Subtype of traffic log; values are start, end, drop, and deny.

• Start: session started
• End: session ended
• Drop: session dropped before the application is identified and there is no rule that allows the session.
• Deny: session dropped after the application is identified and there is a rule to block or no rule that allows the session.

syslogHost :: Traffic -> Bytes

The hostname from the syslog header appended to the PAN-OS log. This field is not documented by Palo Alto Network and technically is not part of the log, but in practice, it is always present. This is similar to deviceName.

timeGenerated :: Traffic -> Datetime

Time the log was generated on the dataplane.

virtualSystem :: Traffic -> Bytes

Virtual System associated with the session.

virtualSystemName :: Traffic -> Bytes

The name of the virtual system associated with the session; only valid on firewalls enabled for multiple virtual systems.

Device Group Hierarchy

deviceGroupHierarchyLevel1 :: Traffic -> Word64

deviceGroupHierarchyLevel2 :: Traffic -> Word64

deviceGroupHierarchyLevel3 :: Traffic -> Word64

deviceGroupHierarchyLevel4 :: Traffic -> Word64