0.0.0.0 syslog host shows up in udp6

[Fox-E-1337]

Version

2.4.111

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

64

Storage for /

150

Storage for /nsm

500

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I am troubleshooting an issue with ingesting syslogs from a PaloAlto NGFW using the elastic agent integration on my forward node. When I set the syslog host to 0.0.0.0 as suggested in #14067 I noticed through the netstat command that it shows the agent is listening on udp6 not on udp. I swapped the syslog host to localhost and then it shows that it is listening on 127.0.0.1 udp.

I have verified that the 99-sysctl.conf file has ipv6 turned off.

Is this expected behavior of the platform and netstat output isnt correct or is there something else at play here? Either configuration the syslogs do not appear to be making it into the platform.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

What is your setting in the host firewall?

[cm-ops]

What format are you sending them in? Also, could there be a timezone offset? You can also check the pipeline stats with sudo so-elasticsearch-pipeline-stats $pipeline, you can get the pipeline names with sudo so-elasticsearch-pipelines-list | grep panw

[Fox-E-1337]

What format are you sending them in? Also, could there be a timezone offset? You can also check the pipeline stats with sudo so-elasticsearch-pipeline-stats $pipeline, you can get the pipeline names with sudo so-elasticsearch-pipelines-list | grep panw

We are sending via UDP in BSD format

[Fox-E-1337]

What format are you sending them in? Also, could there be a timezone offset? You can also check the pipeline stats with sudo so-elasticsearch-pipeline-stats $pipeline, you can get the pipeline names with sudo so-elasticsearch-pipelines-list | grep panw

output from the suggested command on the Manager node:
sudo so-elasticsearch-pipelines-list | grep panw
"logs-panw.panos-3.26.2",
"logs-panw.panos-3.26.2-audit",
"logs-panw.panos-3.26.2-authentication",
"logs-panw.panos-3.26.2-config",
"logs-panw.panos-3.26.2-correlated_event",
"logs-panw.panos-3.26.2-decryption",
"logs-panw.panos-3.26.2-globalprotect",
"logs-panw.panos-3.26.2-gtp",
"logs-panw.panos-3.26.2-hipmatch",
"logs-panw.panos-3.26.2-ip_tag",
"logs-panw.panos-3.26.2-sctp",
"logs-panw.panos-3.26.2-system",
"logs-panw.panos-3.26.2-threat",
"logs-panw.panos-3.26.2-traffic",
"logs-panw.panos-3.26.2-tunnel_inspection",
"logs-panw.panos-3.26.2-userid",

[cm-ops]

Have you tried switching to IETF format? You would check the pipeline with sudo so-elasticsearch-pipeline-stats logs-panw.panos-3.26.2

[Fox-E-1337]

returns mostly zero values :
{
"count": 0,
"time_in_millis": 0,
"current": 0,
"failed": 0,
"processors": [
{
"set": {
"type": "set",
"stats": {
"count": 0,
"time_in_millis": 0,
"current": 0,
"failed": 0
}
}
},
But some appear to have a count:
{
"pipeline:logs-panw.integration@custom": {
"type": "pipeline",
"stats": {
"count": 5988,
"time_in_millis": 0,
"current": 0,
"failed": 0
}
}
}

or  

{
"convert": {
"type": "convert",
"stats": {
"count": 5988,
"time_in_millis": 6,
"current": 0,
"failed": 0
}
}
}