Log Forwarding Profile Objects

Log forwarding profile objects define how logs are forwarded to external systems in Strata Cloud Manager. The scm CLI provides commands to create, update, delete, show, backup, and load log forwarding profile objects.

Overview

The log-forwarding-profile commands allow you to:

Configure log forwarding for different log types
Set filters to control which logs are forwarded
Forward to HTTP servers, syslog servers, or Panorama
Delete log forwarding profiles that are no longer needed
Bulk import log forwarding profiles from YAML files
Export log forwarding profiles for backup or migration

Supported Log Types

Log Type	Description
traffic	Network traffic logs
threat	Threat prevention logs
wildfire	WildFire malware analysis logs
url	URL filtering logs
data	Data filtering logs
tunnel	Tunnel inspection logs
auth	Authentication logs
decryption	SSL/TLS decryption logs
dns-security	DNS security logs

Set Log Forwarding Profile

Create or update a log forwarding profile object.

Syntax

scm set object log-forwarding-profile NAME [OPTIONS]

Arguments

Argument	Description	Required
`NAME`	Name of the log forwarding profile	Yes

Options

Option	Description	Required
`--folder TEXT`	Folder location	Yes*
`--snippet TEXT`	Snippet location	Yes*
`--device TEXT`	Device location	Yes*
`--match-list TEXT`	JSON array of match list configurations	No
`--description TEXT`	Description of the profile	No
`--enhanced-application-logging`	Enable enhanced application logging	No

* Exactly one of --folder, --snippet, or --device is required.

Examples

Create Basic Traffic Log Forwarding

$ scm set object log-forwarding-profile traffic-logs \
    --folder Texas \
    --match-list '[{"name": "all-traffic", "log_type": "traffic", "filter": "All Logs", "syslog_profiles": ["central-syslog"]}]' \
    --description "Forward all traffic logs"
---> 100%
Created log forwarding profile: traffic-logs in folder Texas

Create Threat Log Forwarding with HTTP

$ scm set object log-forwarding-profile threat-logs \
    --folder Texas \
    --match-list '[{"name": "threats", "log_type": "threat", "filter": "All Logs", "http_profiles": ["splunk-hec"], "syslog_profiles": ["security-syslog"]}]' \
    --enhanced-application-logging \
    --description "Forward threat logs to SIEM"
---> 100%
Created log forwarding profile: threat-logs in folder Texas

Create Multi-Destination Forwarding

$ scm set object log-forwarding-profile comprehensive-logging \
    --folder Texas \
    --match-list '[{"name": "traffic", "log_type": "traffic", "filter": "All Logs", "syslog_profiles": ["central-syslog"]}, {"name": "threats", "log_type": "threat", "filter": "All Logs", "http_profiles": ["splunk-hec"]}, {"name": "urls", "log_type": "url", "filter": "All Logs", "http_profiles": ["splunk-hec"]}]' \
    --description "Comprehensive log forwarding"
---> 100%
Created log forwarding profile: comprehensive-logging in folder Texas

Delete Log Forwarding Profile

Delete a log forwarding profile object from SCM.

Syntax

scm delete object log-forwarding-profile NAME [OPTIONS]

Arguments

Argument	Description	Required
`NAME`	Name of the log forwarding profile to delete	Yes

Options

Option	Description	Required
`--folder TEXT`	Folder location	Yes*
`--snippet TEXT`	Snippet location	Yes*
`--device TEXT`	Device location	Yes*
`--force`	Skip confirmation prompt	No

* Exactly one of --folder, --snippet, or --device is required.

Example

$ scm delete object log-forwarding-profile traffic-logs --folder Texas --force
---> 100%
Deleted log forwarding profile: traffic-logs from folder Texas

Load Log Forwarding Profiles

Load multiple log forwarding profile objects from a YAML file.

Syntax

scm load object log-forwarding-profile [OPTIONS]

Options

Option	Description	Required
`--file TEXT`	Path to YAML file containing log forwarding profile definitions	Yes
`--folder TEXT`	Override folder location for all objects	No
`--snippet TEXT`	Override snippet location for all objects	No
`--device TEXT`	Override device location for all objects	No
`--dry-run`	Preview changes without applying them	No

YAML File Format

---
log_forwarding_profiles:
  - name: basic-forwarding
    folder: Texas
    description: "Basic log forwarding"
    match_list:
      - name: all-logs
        log_type: traffic
        filter: "All Logs"
        syslog_profiles:
          - central-syslog

  - name: security-monitoring
    folder: Texas
    description: "Security event monitoring"
    enhanced_application_logging: true
    match_list:
      - name: threats
        log_type: threat
        filter: "All Logs"
        http_profiles:
          - splunk-hec
        syslog_profiles:
          - security-syslog
      - name: wildfire
        log_type: wildfire
        filter: "All Logs"
        http_profiles:
          - splunk-hec

  - name: compliance-logging
    folder: Texas
    description: "Compliance and audit logging"
    match_list:
      - name: traffic-audit
        log_type: traffic
        filter: "( zone.src eq Trust ) and ( zone.dst eq Untrust )"
        syslog_profiles:
          - compliance-syslog
      - name: auth-events
        log_type: auth
        filter: "All Logs"
        syslog_profiles:
          - compliance-syslog

Examples

Load with Original Locations

$ scm load object log-forwarding-profile --file log-profiles.yml
---> 100%
✓ Loaded log forwarding profile: basic-forwarding
✓ Loaded log forwarding profile: security-monitoring
✓ Loaded log forwarding profile: compliance-logging

Successfully loaded 3 out of 3 log forwarding profiles from 'log-profiles.yml'

Load with Folder Override

$ scm load object log-forwarding-profile --file log-profiles.yml --folder Austin
---> 100%
✓ Loaded log forwarding profile: basic-forwarding
✓ Loaded log forwarding profile: security-monitoring
✓ Loaded log forwarding profile: compliance-logging

Successfully loaded 3 out of 3 log forwarding profiles from 'log-profiles.yml'

note

When using container override options (--folder, --snippet, --device), all log forwarding profiles will be loaded into the specified container, ignoring the container specified in the YAML file.

Show Log Forwarding Profile

Display log forwarding profile objects.

Syntax

scm show object log-forwarding-profile [NAME] [OPTIONS]

Arguments

Argument	Description	Required
`NAME`	Name of the log forwarding profile to show; omit to list all	No

Options

Option	Description	Required
`--folder TEXT`	Folder location	Yes*
`--snippet TEXT`	Snippet location	Yes*
`--device TEXT`	Device location	Yes*
`--max-results INTEGER`	Maximum number of results to display	No
`--output [table\|json\|yaml]`	Output format (default: `table`)	No

* Exactly one of --folder, --snippet, or --device is required.

note

When no NAME argument is provided, all items are listed by default.

Examples

Show Specific Log Forwarding Profile

$ scm show object log-forwarding-profile threat-logs --folder Texas
---> 100%
Log Forwarding Profile: threat-logs
  Location: Folder 'Texas'
  Match List:
    - Name: threats
      Log Type: threat
      Filter: All Logs
      HTTP Profiles: splunk-hec
      Syslog Profiles: security-syslog
  Enhanced Application Logging: True
  Description: Forward threat logs to SIEM
  ID: 123e4567-e89b-12d3-a456-426614174000

List All Log Forwarding Profiles (Default Behavior)

$ scm show object log-forwarding-profile --folder Texas
---> 100%
Log Forwarding Profiles in folder 'Texas':
------------------------------------------------------------
Name: traffic-logs
  Location: Folder 'Texas'
  Match List: all-traffic (traffic)
  Description: Forward all traffic logs
------------------------------------------------------------
Name: threat-logs
  Location: Folder 'Texas'
  Match List: threats (threat)
  Enhanced Application Logging: Yes
  Description: Forward threat logs to SIEM
------------------------------------------------------------
Name: comprehensive-logging
  Location: Folder 'Texas'
  Match List: traffic (traffic), threats (threat), urls (url)
  Description: Comprehensive log forwarding
------------------------------------------------------------

Backup Log Forwarding Profiles

Backup all log forwarding profile objects from a specified location to a YAML file.

Syntax

scm backup object log-forwarding-profile [OPTIONS]

Options

Option	Description	Required
`--folder TEXT`	Folder to backup log forwarding profiles from	No*
`--snippet TEXT`	Snippet to backup log forwarding profiles from	No*
`--device TEXT`	Device to backup log forwarding profiles from	No*
`--file TEXT`	Output filename (defaults to auto-generated)	No

* One of --folder, --snippet, or --device is required.

Examples

Backup from Folder

$ scm backup object log-forwarding-profile --folder Texas
---> 100%
Successfully backed up 10 log forwarding profiles to log-forwarding-profile_folder_texas_20240115_120530.yaml

Backup with Custom Filename

$ scm backup object log-forwarding-profile --folder Texas --file texas-log-profiles.yaml
---> 100%
Successfully backed up 10 log forwarding profiles to texas-log-profiles.yaml

Best Practices

Log Type Separation: Create separate match entries for different log types.
Filter Efficiency: Use specific filters to reduce log volume and improve performance.
Destination Planning: Use syslog for traditional log management, HTTP for modern SIEM integration.
Enhanced Logging: Enable enhanced application logging for detailed application information.
Redundancy: Configure multiple destinations for critical logs.
Use YAML for Bulk Operations: For complex deployments, use YAML files.

Overview​

Supported Log Types​

Set Log Forwarding Profile​

Syntax​

Arguments​

Options​

Examples​

Create Basic Traffic Log Forwarding​

Create Threat Log Forwarding with HTTP​

Create Multi-Destination Forwarding​

Delete Log Forwarding Profile​

Syntax​

Arguments​

Options​

Example​

Load Log Forwarding Profiles​

Syntax​

Options​

YAML File Format​

Examples​

Load with Original Locations​

Load with Folder Override​

Show Log Forwarding Profile​

Syntax​

Arguments​

Options​

Examples​

Show Specific Log Forwarding Profile​

List All Log Forwarding Profiles (Default Behavior)​

Backup Log Forwarding Profiles​

Syntax​

Options​

Examples​

Backup from Folder​

Backup with Custom Filename​

Best Practices​

Overview

Supported Log Types

Set Log Forwarding Profile

Syntax

Arguments

Options

Examples

Create Basic Traffic Log Forwarding

Create Threat Log Forwarding with HTTP

Create Multi-Destination Forwarding

Delete Log Forwarding Profile

Syntax

Arguments

Options

Example

Load Log Forwarding Profiles

Syntax

Options

YAML File Format

Examples

Load with Original Locations

Load with Folder Override

Show Log Forwarding Profile

Syntax

Arguments

Options

Examples

Show Specific Log Forwarding Profile

List All Log Forwarding Profiles (Default Behavior)

Backup Log Forwarding Profiles

Syntax

Options

Examples

Backup from Folder

Backup with Custom Filename

Best Practices