X10 DividendLog Samples
Palo Alto
PAN-OS traffic log samples in comma-separated format.
Source: PAN-OS syslog format KB. Comma-separated, positional — no field names. Already near-minimal, so reformatting alone returns little; the value is in dropping fields and start events.
Traffic
The first line sends the hostname (PA-VM300-goran1); the second has that option
off, so it opens one field earlier.
1,2014/01/28 01:28:35,007200001056,TRAFFIC,end,1,2014/01/28 01:28:34,192.168.41.30,192.168.41.255,10.193.16.193,192.168.41.255,allow-all,,,netbios-ns,vsys1,Trust,Untrust,ethernet1/1,ethernet1/2,To-Panorama,2014/01/28 01:28:34,8720,1,137,137,11637,137,0x400000,udp,allow,276,276,0,3,2014/01/28 01:28:02,2,any,0,2076326,0x0,192.168.0.0-192.168.255.255,192.168.0.0-192.168.255.255,0,3,0
1,2014/01/28 01:28:38,007200001057,TRAFFIC,end,1,2014/01/28 01:28:37,192.168.22.123,192.168.22.255,10.193.16.193,192.168.22.255,allow-all,,,netbios-dg,vsys1,Trust,Untrust,ethernet1/1,ethernet1/2,To-Panorama,2014/01/28 01:28:37,8721,1,138,138,3040,138,0x400000,udp,allow,243,243,0,1,2014/01/28 01:28:07,0,any,0,2076327,0x0,192.168.0.0-192.168.255.255,192.168.0.0-192.168.255.255,0,1,0The Threat/Content Type field reads end here. A firewall logging both start
and end writes a near-duplicate start line per session — the target for the
session-start lever.