<14>Nov 12 16:13:21 DC1-PA3220-1 1,2023/11/12 16:13:21,016201032964,TRAFFIC,drop,2562,2023/11/12 16:13:21,80.161.13.209,197.215.1.142,0.0.0.0,0.0.0.0,Block EDL,,,not-applicable,vsys1,Untrust,Untrust,ae3.650,,Witfoo Log Forward Only,2023/11/12 16:13:21,0,1,34058,7676,0,0,0x0,tcp,deny,70,70,0,1,2023/11/12 16:13:21,0,any,,7299323810370952898,0x0,Indonesia,United States,,1,0,policy-deny,265,0,0,0,,DC1-PA3220-1,from-policy,,,0,,0,,N/A,0,0,0,0,9c9bdc16-a293-4006-8e12-bbeec26a625d,0,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2023-11-12T16:13:21.319-08:00,,,unknown,unknown,unknown,1,,,not-applicable,no,no,0
This is a syslog message from a product called PAN NGFW by Palo Alto. The following fields were extracted from the message:
action: block
application: not-applicable
clientbytes: 70
clientpackets: 1
clientport: 34058
facilitycode: 1
facilitylabel: user-level
localhostname: DC1-PA3220-1
localstarttime: Nov 12 16:13:21
messagetype: traffic_drop
priority: 14
protocol: 6
rulename: Block EDL
senderhost: 10.99.10.30
sensitivity: normal
serverport: 7676
severitycode: 6
severitylabel: informational
sourceinfo: unknown
tags: ['rfc3164', 'pan_firewall', 'traffic_drop']
totalbytes: 70
streamName: pan_firewall
clientIP: 80.161.13.209
serverIP: 197.215.1.142