Log server

The Palo Alto Networks log server serves as the heart of the event logging and processing system, ensuring the events you care about don't go unrecorded.

For a deep dive into managing the Log server, check out Managing the log server.

As a brief overview, the log server:

• Monitors events. As Trust Protection Foundation components manage your encryption assets the log server tracks all the events to see if there is a notification rule for each event, and if there is, sends the information to the proper channel for processing.

• Maintains an audit trail. Every event gets logged to the default channel, giving you a comprehensive record of all system activities and events. By default, this is an SQL Server channel, and events are stored in either the Palo Alto Networks Trust Protection Foundation database, or another database you configure, however you can use a different channel, like a File channel, as your default if you prefer.

• Takes actions specified by channels. When notification rules are triggered by events, the event data is processed by the channel specified in the rule. The log server follows the channel configuration settings to transmit the event log information to the specified destination.