<14>Apr 10 10:19:23 DC1-PA3220-1 1,2024/04/10 10:19:23,016201032964,TRAFFIC,drop,2562,2024/04/10 10:19:23,169.243.193.246,250.192.64.43,0.0.0.0,0.0.0.0,Geo Block Inbound,,,not-applicable,vsys1,Untrust,Untrust,ethernet1/2,,Witfoo Log Forward Only,2024/04/10 10:19:23,0,1,45621,65255,0,0,0x0,tcp,deny,60,60,0,1,2024/04/10 10:19:21,0,any,,7349646988834847758,0x0,Bulgaria,United States,,1,0,policy-deny,265,0,0,0,,DC1-PA3220-1,from-policy,,,0,,0,,N/A,0,0,0,0,9dc1d0e6-c8d6-4b80-a7bc-5152b5f5105b,0,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2024-04-10T10:19:23.221-07:00,,,unknown,unknown,unknown,1,,,not-applicable,no,no,0
This is a syslog message from a product called PAN NGFW by Palo Alto. The following fields were extracted from the message:
action: block
application: not-applicable
clientport: 65255
facilitycode: 1
facilitylabel: user-level
localhostname: DC1-PA3220-1
localstarttime: Apr 10 10:19:23
messagetype: traffic_drop
priority: 14
protocol: 6
rulename: Geo Block Inbound
senderhost: 10.99.10.30
sensitivity: normal
serverbytes: 60
serverpackets: 1
serverport: 45621
severitycode: 6
severitylabel: informational
sourceinfo: unknown
tags: ['rfc3164', 'pan_firewall', 'traffic_drop']
totalbytes: 60
streamName: pan_firewall
clientIP: 250.192.64.43
serverIP: 169.243.193.246