--- title: Palo Alto Networks Firewall description: Monitor Palo Alto Networks firewall metrics, network device metadata, and logs breadcrumbs: Docs > Integrations > Palo Alto Networks Firewall --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Palo Alto Networks Firewall Supported OS Integration version3.3.0 {% callout %} # Important note for users on the following Datadog sites: us2.ddog-gov.com {% alert level="info" %} To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator. To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com). {% /alert %} {% /callout %} ## Overview{% #overview %} Datadog's Palo Alto Networks Firewall Log integration allows customers to ingest, parse, and analyze Palo Alto Networks firewall logs. This log integration relies on the HTTPS log templating and forwarding capability provided by PAN OS, the operating system that runs in Palo Alto firewalls. PAN-OS allows customers to forward threat, traffic, authentication, and other important log events. ### Key use cases{% #key-use-cases %} #### Respond to high severity threat events{% #respond-to-high-severity-threat-events %} Firewall threat logs provide context on threats detected by a firewall, which can be filtered and analyzed by severity, type, origin IPs/countries, and more. #### Make informed decisions on Firewall deployment{% #make-informed-decisions-on-firewall-deployment %} Firewall traffic logs can be used to measure the traffic and sessions passing through a firewall and also gives you the ability to monitor for anomalous throughput across firewall deployment. #### Monitor authentication anomalies{% #monitor-authentication-anomalies %} Firewall authentication logs provide detailed information on users as they authenticate with Palo Alto Networks firewall. These logs can be used to monitor anomalous spikes in authentication traffic from specific protocols, users, locations, and more. **Minimum Agent version:** 7.31.1 ## Setup{% #setup %} ### Log collection{% #log-collection %} 1. [Install the Datadog Agent](https://app.datadoghq.com/account/settings/agent/latest) on a machine that is reachable by the firewall and can connect to the internet. Confirm that log collection is enabled. To enable log collection, change `logs_enabled: false` to `logs_enabled: true` in your Agent's main configuration file (datadog.yaml). See the [Host Agent Log collection documentation](https://docs.datadoghq.com/agent/logs.md) for more information and examples. 1. In PanOS, Select Device » Server Profiles » Syslog , add a name for the server profile. Follow the Syslog log forwarding [configuration steps](https://www.youtube.com/watch?v=LOPXg0oCMPs). Same steps listed below. 1. Click Add and provide the following details of the server: - Name of the server - IP address of the machine with datadog agent - Transport as TCP - Port as 10518 and format as BSD 1. Copy and configure custom log format for the required log type. The formats below are mappings from the formats listed in [the Palo Alto Networks Syslog Field Descriptions docs](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions). | Name | Format | | ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Traffic Log | {% collapsible-section %} View Payload `timestamp=$time_generated, serial=$serial, type=$type, subtype=$subtype, time_generated=$time_generated, network.client.ip=$src, network.destination.ip=$dst, natsrc=$natsrc, natdst=$natdst, rule=$rule, usr.id=$srcuser, dstuser=$dstuser, app=$app, vsys=$vsys, source_zone=$from, destination_zone=$to, inbound_if=$inbound_if, outbound_if=$outbound_if, logset=$logset, sessionid=$sessionid, repeatcnt=$repeatcnt, network.client.port=$sport, network.destination.port=$dport, natsport=$natsport natdport=$natdport, flags=$flags, proto=$proto, evt.name=$action, bytes=$bytes, network.bytes_read=$bytes_sent, network.bytes_written=$bytes_received, start=$start, elapsed=$elapsed, category=$category, seqno=$seqno, actionflags=$actionflags, network.client.geoip.country.name=$srcloc, dstloc=$dstloc, pkts_sent=$pkts_sent, pkts_received=$pkts_received, session_end_reason=$session_end_reason, device_name=$device_name, action_source=$action_source, src_uuid=$src_uuid, dst_uuid=$dst_uuid, tunnelid=$tunnelid, imsi= $imsi, monitortag=$monitortag, imei=$imei, parent_session_id=$parent_session_id, parent_start_time=$parent_start_time, tunnel=$tunnel, assoc_id=$assoc_id, chunks=$chunks chunks_sent=$chunks_sent chunks_received=$chunks_received` {% /collapsible-section %} | | Threat Log (and WildFire Submissions Log) | {% collapsible-section %} View Payload `timestamp=$receive_time, serial=$serial, type=$type, subtype=$subtype, time_generated=$time_generated, network.client.ip=$src, network.destination.ip=$dst, natsrc=$natsrc, natdst=$natdst, rule=$rule, usr.id=$srcuser, dstuser=$dstuser, app=$app, vsys=$vsys, source_zone=$from, destination_zone=$to, inbound_if=$inbound_if, outbound_if=$outbound_if, logset=$logset, sessionid=$sessionid, repeatcnt=$repeatcnt, network.client.port=$sport, network.destination.port=$dport, natsport=$natsport, natdport=$natdport, flags=$flags, proto=$proto, evt.name=$action, misc=$misc, threatid=$threatid, category=$category, severity=$severity, direction=$direction, seqno=$seqno, actionflags=$actionflags, network.client.geoip.country.name=$srcloc, dstloc=$dstloc, contenttype=$contenttype, pcap_id=$pcap_id, filedigest=$filedigest, cloud=$cloud, url_idx=$url_idx, http.useragent=$user_agent, filetype=$filetype, xff=$xff referer=$referer, sender=$sender, subject=$subject, recipient=$recipient, reportid=$reportid, vsys_name=$vsys_name, device_name=$device_name, src_uuid=$src_uuid, dst_uuid=$dst_uuid, http_method=$http_method, tunnel_id=$tunnel_id, imsi=$imsi, monitortag=$monitortag, imei=$imei, parent_session_id=$parent_session_id, parent_start_time=$parent_start_time, tunnel=$tunnel, thr_category=$thr_category, contentver=$contentver, assoc_id=$assoc_id, ppid=$ppid, http_headers=$http_headers` {% /collapsible-section %} | | Authentication Log | {% collapsible-section %} View Payload `timestamp=$time_generated, serial=$serial, type=$type, subtype=$subtype, vsys=$vsys, network.client.ip=$ip, usr.id=$user, normalize_user=$normalize_user, object=$object, authpolicy=$authpolicy, repeatcnt=$repeatcnt, authid=$authid, vendor=$vendor , logset=$logset, serverprofile=$serverprofile, message=$message ,clienttype=$clienttype, evt.outcome=$event, factorno=$factorno, seqno=$seqno, actionflags=$actionflags, vsys_name=$vsys_name, device_name=$device_name, vsys_id=$vsys_id, evt.name=$authproto` {% /collapsible-section %} | | HIP Match Log | {% collapsible-section %} View Payload `timestamp=$time_generated, serial=$serial, type=$type, subtype=$subtype, time_generated=$time_generated, usr.id=$srcuser, vsys=$vsys, machinename=$machinename, os=$os, network.client.ip=$src, matchname=$matchname, repeatcnt=$repeatcnt, matchtype=$matchtype, seqno=$seqno, actionflags=$actionflags, vsys_name=$vsys_name, device_name=$device_name, vsys_id=$vsys_id, srcipv6=$srcipv6, hostid=$hostid` {% /collapsible-section %} | | User-ID Log | {% collapsible-section %} View Payload `timestamp=$time_generated, serial=$serial, type=$type, subtype=$subtype, vsys=$vsys, network.client.ip=$ip, usr.id=$user, datasourcename=$datasourcename, evt.name=$eventid, repeatcnt=$repeatcnt, timeout=$timeout, network.client.port=$beginport, network.destination.port=$endport, datasource=$datasource, datasourcetype=$datasourcetype, seqno=$seqno, actionflags=$actionflags, vsys_name=$vsys_name, device_name=$device_name, vsys_id=$vsys_id, factortype=$factortype, factorcompletiontime=$factorcompletiontime,, factorno=$factorno, ugflags=$ugflags, userbysource=$userbysource` {% /collapsible-section %} | | Tunnel Inspection Log | {% collapsible-section %} View Payload `timestamp=$time_generated, serial=$serial, type=$type, subtype=$subtype, network.client.ip=$src, network.destination.ip=$dst, natsrc=$natsrc, natdst=$natdst, rule=$rule, usr.id=$srcuser, dstuser=$dstuser, app=$app, vsys=$vsys, source_zone=$from, destination_zone=$to, inbound_if=$inbound_if, outbound_if=$outbound_if, logset=$logset, sessionid=$sessionid, repeatcnt=$repeatcnt, network.client.port=$sport, network.destination.port=$dport, natsport=$natsport, natdport=$natdport, flags=$flags, proto=$proto, evt.outcome=$action, severity=$severity, seqno=$seqno, actionflags=$actionflags, srcloc=$srcloc, dstloc=$dstloc, vsys_name=$vsys_name, device_name=$device_name, tunnelid=$tunnelid, monitortag=$monitortag, parent_session_id=$parent_session_id, parent_start_time=$parent_start_time, tunnel=$tunnel, bytes=$bytes, network.bytes_read=$bytes_sent, network.bytes_written=$bytes_received, packets=$packets, pkts_sent=$pkts_sent, pkts_received=$pkts_received, max_encap=$max_encap, unknown_proto=$unknown_proto, strict_check=$strict_check, tunnel_fragment=$tunnel_fragment, sessions_created=$sessions_created, sessions_closed=$sessions_closed, session_end_reason=$session_end_reason, evt.name=$action_source, start=$start, elapsed=$elapsed, tunnel_insp_rule=$tunnel_insp_rule` {% /collapsible-section %} | | SCTP Log | {% collapsible-section %} View Payload `timestamp=$time_generated, serial=$serial, type=$type, network.client.ip=$src, network.destination.ip=$dst, rule=$rule, vsys=$vsys, source_zone=$from, destination_zone=$to, inbound_if=$inbound_if, outbound_if=$outbound_if, logset=$logset, sessionid=$sessionid, repeatcnt=$repeatcnt, network.client.port=$sport, network.destination.port=$dport, proto=$proto, action=$action, vsys_name=$vsys_name, device_name=$device_name, seqno=$seqno, assoc_id=$assoc_id, ppid=$ppid, severity=$severity, sctp_chunk_type=$sctp_chunk_type, sctp_event_type=$sctp_event_type, verif_tag_1=$verif_tag_1, verif_tag_2=$verif_tag_2, sctp_cause_code=$sctp_cause_code, diam_app_id=$diam_app_id, diam_cmd_code=$diam_cmd_code, diam_avp_code=$diam_avp_code, stream_id=$stream_id, assoc_end_reason=$assoc_end_reason, op_code=$op_code, sccp_calling_ssn=$sccp_calling_ssn, sccp_calling_gt=$sccp_calling_gt, sctp_filter=$sctp_filter, chunks=$chunks, chunks_sent=$chunks_sent, chunks_received=$chunks_received, packets=$packets, pkts_sent=$pkts_sent, pkts_received=$pkts_received` {% /collapsible-section %} | | Config Log | {% collapsible-section %} View Payload `timestamp=$time_generated, serial=$serial, type=$type, subtype=$subtype, network.client.ip=$host, vsys=$vsys, evt.name=$cmd, usr.id=$admin, client=$client, evt.outcome=$result, path=$path, before_change_detail=$before_change_detail, after_change_detail=$after_change_detail, seqno=$seqno, actionflags=$actionflags, vsys_name=$vsys_name, device_name=$device_name` {% /collapsible-section %} | | System Log | {% collapsible-section %} View Payload `timestamp=$time_generated, serial=$serial, type=$type, subtype=$subtype, vsys=$vsys, evt.name=$eventid, object=$object, module=$module, severity=$severity, opaque=$opaque, seqno=$seqno, actionflags=$actionflags, vsys_name=$vsys_name, device_name=$device_name` {% /collapsible-section %} | | Correlated Events Log | {% collapsible-section %} View Payload `timestamp=$time_generated, serial=$serial, type=$type, subtype=$subtype, vsys=$vsys, evt.name=$eventid, object=$object, module=$module, severity=$severity, opaque=$opaque, seqno=$seqno, actionflags=$actionflags, vsys_name=$vsys_name, device_name=$device_name` {% /collapsible-section %} | | GTP Log | {% collapsible-section %} View Payload `timestamp=$start, serial=$serial, type=$type, subtype=$subtype, network.client.ip=$src, network.destination.ip=$dst, rule=$rule, app=$app, vsys=$vsys, source_zone=$from, destination_zone=$to, inbound_if=$inbound_if, outbound_if=$outbound_if, logset=$logset, sessionid=$sessionid, network.client.port=$sport, network.destination.port=$dport, proto=$proto, evt.name=$action, event_type=$event_type, msisdn=$msisdn, apn=$apn, rat=$rat, msg_type=$msg_type, end_ip_adr=$end_ip_adr, teid1=$teid1, teid2=$teid2, gtp_interface=$gtp_interface, cause_code=$cause_code, severity=$severity, mcc=$mcc, mnc=$mnc, area_code=$area_code, cell_id=$cell_id, event_code=$event_code, srcloc=$srcloc, dstloc=$dstloc, imsi=$imsi, imei=$imei, start=$start, elapsed=$elapsed, tunnel_insp_rule=$tunnel_insp_rule` {% /collapsible-section %} | | Data Filtering Log | {% collapsible-section %} View Payload `timestamp=$receive_time, serial=$serial, type=$type, subtype=$subtype, time_generated=$time_generated, network.client.ip=$src, network.destination.ip=$dst, natsrc=$natsrc, natdst=$natdst, rule=$rule, usr.id=$srcuser, dstuser=$dstuser, app=$app, vsys=$vsys, source_zone=$from, destination_zone=$to, inbound_if=$inbound_if, outbound_if=$outbound_if, logset=$logset, sessionid=$sessionid, repeatcnt=$repeatcnt, network.client.port=$sport, network.destination.port=$dport, natsport=$natsport, natdport=$natdport, flags=$flags, proto=$proto, evt.name=$action, misc=$misc, threatid=$threatid, category=$category, severity=$severity, direction=$direction, seqno=$seqno, actionflags=$actionflags, network.client.geoip.country.name=$srcloc, dstloc=$dstloc, contenttype=$contenttype, pcap_id=$pcap_id, filedigest=$filedigest, cloud=$cloud, url_idx=$url_idx, http.useragent=$user_agent, filetype=$filetype, xff=$xff, referer=$referer, sender=$sender, subject=$subject, recipient=$recipient, reportid=$reportid, vsys_name=$vsys_name, device_name=$device_name, src_uuid=$src_uuid, dst_uuid=$dst_uuid, http_method=$http_method, tunnel_id=$tunnel_id, imsi=$imsi, monitortag=$monitortag, imei=$imei, parent_session_id=$parent_session_id, parent_start_time=$parent_start_time, tunnel=$tunnel, thr_category=$thr_category, contentver=$contentver, assoc_id=$assoc_id, ppid=$ppid, http_headers=$http_headers, url_category_list=$url_category_list, rule_uuid=$rule_uuid, http2_connection=$http2_connection, dynusergroup_name=$dynusergroup_name, xff_ip=$xff_ip, src_osfamily=$src_osfamily, src_osversion=$src_osversion, src_host=$src_host, src_mac=$src_mac, dst_osfamily=$dst_osfamily, dst_osversion=$dst_osversion, dst_host=$dst_host, dst_mac=$dst_mac, container_id=$container_id, pod_namespace=$pod_namespace, pod_name=$pod_name, src_edl=$src_edl, dst_edl=$dst_edl, hostid=$hostid, serialnumber=$serialnumber, domain_edl=$domain_edl, src_dag=$src_dag, dst_dag=$dst_dag, partial_hash=$partial_hash, high_res_timestamp=$high_res_timestamp, reason=$reason, justification=$justification` {% /collapsible-section %} | | URL Filtering Log | {% collapsible-section %} View Payload `timestamp=$receive_time, serial=$serial, type=$type, subtype=$subtype, time_generated=$time_generated, network.client.ip=$src, network.destination.ip=$dst, natsrc=$natsrc, natdst=$natdst, rule=$rule, usr.id=$srcuser, dstuser=$dstuser, app=$app, vsys=$vsys, source_zone=$from, destination_zone=$to, inbound_if=$inbound_if, outbound_if=$outbound_if, logset=$logset, sessionid=$sessionid, repeatcnt=$repeatcnt, network.client.port=$sport, network.destination.port=$dport, natsport=$natsport, natdport=$natdport, flags=$flags, proto=$proto, evt.name=$action, misc=$misc, threatid=$threatid, category=$category, severity=$severity, direction=$direction, seqno=$seqno, actionflags=$actionflags, network.client.geoip.country.name=$srcloc, dstloc=$dstloc, contenttype=$contenttype, pcap_id=$pcap_id, filedigest=$filedigest, cloud=$cloud, url_idx=$url_idx, http.useragent=$user_agent, filetype=$filetype, xff=$xff, referer=$referer, sender=$sender, subject=$subject, recipient=$recipient, reportid=$reportid, vsys_name=$vsys_name, device_name=$device_name, src_uuid=$src_uuid, dst_uuid=$dst_uuid, http_method=$http_method, tunnel_id=$tunnel_id, imsi=$imsi, monitortag=$monitortag, imei=$imei, parent_session_id=$parent_session_id, parent_start_time=$parent_start_time, tunnel=$tunnel, thr_category=$thr_category, contentver=$contentver, assoc_id=$assoc_id, ppid=$ppid, http_headers=$http_headers, url_category_list=$url_category_list, rule_uuid=$rule_uuid, http2_connection=$http2_connection, dynusergroup_name=$dynusergroup_name, xff_ip=$xff_ip, src_osfamily=$src_osfamily, src_osversion=$src_osversion, src_host=$src_host, src_mac=$src_mac, dst_osfamily=$dst_osfamily, dst_osversion=$dst_osversion, dst_host=$dst_host, dst_mac=$dst_mac, container_id=$container_id, pod_namespace=$pod_namespace, pod_name=$pod_name, src_edl=$src_edl, dst_edl=$dst_edl, hostid=$hostid, serialnumber=$serialnumber, domain_edl=$domain_edl, src_dag=$src_dag, dst_dag=$dst_dag, partial_hash=$partial_hash, high_res_timestamp=$high_res_timestamp, reason=$reason, justification=$justification` {% /collapsible-section %} | | GlobalProtect Log | {% collapsible-section %} View Payload `timestamp=$receive_time, serial=$serial, type=$type, subtype=$subtype, time_generated=$time_generated, vsys=$vsys, evt.name=$eventid, stage=$stage, auth_method=$auth_method, tunnel_type=$tunnel_type, usr.id=$srcuser, srcregion=$srcregion, machinename=$machinename, public_ip=$public_ip, public_ipv6=$public_ipv6, private_ip=$private_ip, private_ipv6=$private_ipv6, hostid=$hostid, serialnumber=$serialnumber, client_ver=$client_ver, client_os=$client_os, client_os_ver=$client_os_ver, repeatcnt=$repeatcnt, reason=$reason, error=$error, opaque=$opaque, status=$status, location=$location, login_duration=$login_duration, connect_method=$connect_method, error_code=$error_code, portal=$portal, seqno=$seqno, actionflags=$actionflags, selection_type=$selection_type, response_time=$response_time, priority=$priority, attempted_gateways=$attempted_gateways, gateway=$gateway, dg_hier_level_1=$dg_hier_level_1, dg_hier_level_2=$dg_hier_level_2, dg_hier_level_3=$dg_hier_level_3, dg_hier_level_4=$dg_hier_level_4, vsys_name=$vsys_name, device_name=$device_name, vsys_id=$vsys_id` {% /collapsible-section %} | 1. Click OK, this creates a syslog server profile. 1. Click on the Objects tab, this opens the log forwarding profile screen. 1. Create log forwarding profile by providing the name, log type and syslog profile 1. Create a pan.firewall.d/conf.yaml file at the root of the [Agent's configuration directory](https://docs.datadoghq.com/agent/guide/agent-configuration-files.md?tab=agentv6v7) with the below content. ```yaml logs: - type: tcp port: 10518 service: "firewall" source: "pan.firewall" ``` 1. [Restart Agent](https://docs.datadoghq.com/agent/guide/agent-commands.md#start-stop-and-restart-the-agent). ## Data Collected{% #data-collected %} ### Metrics{% #metrics %} | | | | | **pan_firewall.api.authentication.status**(gauge) | Whether the API rejected the credentials (1 = invalid credentials, 0 = OK). | | **pan_firewall.bgp.peer.prefix_limit**(gauge) | Configured maximum prefixes. | | **pan_firewall.bgp.peer.prefix_limit.utilization**(gauge) | Received prefixes as a percentage of the configured limit.*Shown as percent* | | **pan_firewall.bgp.peer.prefixes.incoming.rejected**(gauge) | Prefixes rejected. | | **pan_firewall.bgp.peer.prefixes.incoming.total**(gauge) | Prefixes received. | | **pan_firewall.bgp.peer.prefixes.outgoing.advertised**(gauge) | Prefixes advertised. | | **pan_firewall.bgp.peer.prefixes.outgoing.total**(gauge) | Prefixes to send. | | **pan_firewall.bgp.peer.restart**(gauge) | Whether the BGP peer came up in the last 30 minutes (1 = came up, 0 = did not come up). | | **pan_firewall.bgp.peer.status**(gauge) | Whether the BGP peer is established (1 = established, 0 = not established). | | **pan_firewall.bgp.peer.status_duration**(gauge) | Time in the current state.*Shown as second* | | **pan_firewall.bgp.peer.updates.in**(count) | Update messages received.*Shown as message* | | **pan_firewall.bgp.peer.updates.out**(count) | Update messages sent.*Shown as message* | | **pan_firewall.can_connect**(gauge) | Whether the firewall API responded during the last check run (1 = responded, 0 = did not respond). | | **pan_firewall.counter.global**(count) | Increase of the PAN-OS global counter, tagged by counter name, category, and aspect. | | **pan_firewall.dataplane.cpu.utilization**(gauge) | Data-plane CPU utilization per core.*Shown as percent* | | **pan_firewall.disk.used_pct**(gauge) | Percentage of file system space used, reported every 30 minutes. Not sent for the `none`, `tmpfs`, or `cgroup_root` file systems.*Shown as percent* | | **pan_firewall.dropped_packets**(count) | Dropped packets by aspect. Known aspects report 0 when they have no drops. Other aspects, such as `mgmt`, are reported when present.*Shown as packet* | | **pan_firewall.interface.attack.ip_spoof**(count) | IP-spoofed packets.*Shown as packet* | | **pan_firewall.interface.attack.land**(count) | LAND attack packets.*Shown as packet* | | **pan_firewall.interface.attack.mac_spoof**(count) | MAC-spoofed packets.*Shown as packet* | | **pan_firewall.interface.attack.ping_of_death**(count) | Ping-of-death packets.*Shown as packet* | | **pan_firewall.interface.attack.teardrop**(count) | Teardrop packets.*Shown as packet* | | **pan_firewall.interface.flow_state**(count) | Packets dropped by flow state check.*Shown as packet* | | **pan_firewall.interface.forward_errors**(count) | Forwarding errors.*Shown as packet* | | **pan_firewall.interface.rx.bytes**(count) | Bytes received.*Shown as byte* | | **pan_firewall.interface.rx.drops**(count) | Receive drops.*Shown as packet* | | **pan_firewall.interface.rx.errors**(count) | Receive errors.*Shown as packet* | | **pan_firewall.interface.rx.packets**(count) | Packets received.*Shown as packet* | | **pan_firewall.interface.speed**(gauge) | Interface speed, reported every 30 minutes. Not sent when the speed is `ukn` or `[n/a]`.*Shown as bit* | | **pan_firewall.interface.tx.bytes**(count) | Bytes sent.*Shown as byte* | | **pan_firewall.interface.tx.packets**(count) | Packets sent.*Shown as packet* | | **pan_firewall.ipsec.gateways.total**(gauge) | IKE gateways configured. | | **pan_firewall.ipsec.tunnel.rx.bytes**(count) | Bytes received through the IPsec tunnel.*Shown as byte* | | **pan_firewall.ipsec.tunnel.rx.packets**(count) | Packets received through the IPsec tunnel.*Shown as packet* | | **pan_firewall.ipsec.tunnel.state**(gauge) | IPsec tunnel state (0 = inactive, 1 = active, 2 = initializing). Unknown states are not sent. | | **pan_firewall.ipsec.tunnel.tx.bytes**(count) | Bytes sent through the IPsec tunnel.*Shown as byte* | | **pan_firewall.ipsec.tunnel.tx.packets**(count) | Packets sent through the IPsec tunnel.*Shown as packet* | | **pan_firewall.ipsec.tunnels.active**(gauge) | Tunnels active. | | **pan_firewall.ipsec.tunnels.inactive**(gauge) | Tunnels inactive. | | **pan_firewall.ipsec.tunnels.init**(gauge) | Tunnels initializing. | | **pan_firewall.ipsec.tunnels.total**(gauge) | IPsec tunnels configured. | | **pan_firewall.license.days_left**(gauge) | Days until the license expires, reported every 24 hours. Not sent for perpetual licenses.*Shown as day* | | **pan_firewall.license.expired**(gauge) | Whether the license has expired (1 = expired, 0 = not expired), reported every 24 hours. | | **pan_firewall.mgmt.cpu.hardirq**(gauge) | Management-plane CPU, hardware interrupts.*Shown as percent* | | **pan_firewall.mgmt.cpu.idle**(gauge) | Management-plane CPU, idle.*Shown as percent* | | **pan_firewall.mgmt.cpu.iowait**(gauge) | Management-plane CPU, I/O wait.*Shown as percent* | | **pan_firewall.mgmt.cpu.nice**(gauge) | Management-plane CPU, nice.*Shown as percent* | | **pan_firewall.mgmt.cpu.softirq**(gauge) | Management-plane CPU, software interrupts.*Shown as percent* | | **pan_firewall.mgmt.cpu.steal**(gauge) | CPU stolen by the hypervisor (VM-Series).*Shown as percent* | | **pan_firewall.mgmt.cpu.system**(gauge) | Management-plane CPU, system.*Shown as percent* | | **pan_firewall.mgmt.cpu.used**(gauge) | Management-plane CPU used.*Shown as percent* | | **pan_firewall.mgmt.cpu.user**(gauge) | Management-plane CPU, user.*Shown as percent* | | **pan_firewall.mgmt.memory.available**(gauge) | Memory available for new processes without swapping.*Shown as byte* | | **pan_firewall.mgmt.memory.buff_cache**(gauge) | Buffers and cache.*Shown as byte* | | **pan_firewall.mgmt.memory.free**(gauge) | Free memory.*Shown as byte* | | **pan_firewall.mgmt.memory.total**(gauge) | Total memory.*Shown as byte* | | **pan_firewall.mgmt.memory.used**(gauge) | Used memory.*Shown as byte* | | **pan_firewall.mgmt.memory.used_pct**(gauge) | Percentage of management-plane memory in use.*Shown as percent* | | **pan_firewall.mgmt.swap.free**(gauge) | Free swap.*Shown as byte* | | **pan_firewall.mgmt.swap.total**(gauge) | Total swap.*Shown as byte* | | **pan_firewall.mgmt.swap.used**(gauge) | Used swap.*Shown as byte* | | **pan_firewall.mgmt.swap.used_pct**(gauge) | Percentage of management-plane swap in use.*Shown as percent* | | **pan_firewall.ospf.neighbor.status**(gauge) | Whether the OSPF neighbor is in the `full` state (1 = full, 0 = not full). | | **pan_firewall.panorama.can_connect**(gauge) | Whether the Panorama discovery call succeeded (1 = succeeded, 0 = failed). | | **pan_firewall.power.alarm.high**(gauge) | Whether the power sensor is in alarm above the maximum (1 = in alarm, 0 = not in alarm). | | **pan_firewall.power.alarm.low**(gauge) | Whether the power sensor is in alarm below the minimum (1 = in alarm, 0 = not in alarm). | | **pan_firewall.power.voltage**(gauge) | Current voltage.*Shown as volt* | | **pan_firewall.power.voltage.max**(gauge) | Maximum voltage threshold.*Shown as volt* | | **pan_firewall.power.voltage.min**(gauge) | Minimum voltage threshold.*Shown as volt* | | **pan_firewall.report.top.bytes**(gauge) | Traffic in the last 24 hours, reported every 30 minutes.*Shown as byte* | | **pan_firewall.report.top.bytes_per_session**(gauge) | Average traffic per session, reported every 30 minutes.*Shown as byte* | | **pan_firewall.report.top.sessions**(gauge) | Sessions in the last 24 hours, reported every 30 minutes.*Shown as session* | | **pan_firewall.security_rule.hits**(count) | Hits per security rule.*Shown as hit* | | **pan_firewall.temperature.alarm**(gauge) | Whether the temperature sensor is in alarm (1 = in alarm, 0 = not in alarm). | | **pan_firewall.temperature.current**(gauge) | Current temperature.*Shown as degree celsius* | | **pan_firewall.temperature.max**(gauge) | Maximum threshold.*Shown as degree celsius* | | **pan_firewall.temperature.min**(gauge) | Minimum threshold.*Shown as degree celsius* | | **pan_firewall.threat.count**(count) | Threat logs received. | ### Logs{% #logs %} The PANOS integration collects logs from the Palo Alto Networks firewall integration and forwards them to Datadog. ### Events{% #events %} The PANOS integration does not send any events. ### Service Checks{% #service-checks %} The PANOS integration does not include any service checks. ## Troubleshooting{% #troubleshooting %} Need help? Contact [Datadog support](https://docs.datadoghq.com/help/). ## Further Reading{% #further-reading %} Additional helpful documentation, links, and articles: - [Palo Alto Networks Firewall documentation](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions) - [Log Collection and Integrations](https://docs.datadoghq.com/logs/log_collection.md?tab=tailexistingfiles#getting-started-with-the-agent)