# panos-parser(): parsing PAN-OS log messages

The [PAN-OS](<https://docs.paloaltonetworks.com/pan-os.html>) (a short version of Palo Alto Networks Operating System) parser can parse log messages originating from [Palo Alto Networks](<https://www.paloaltonetworks.com/>) devices. Even though these messages completely comply to the RFC standards, their `MESSAGE` part is not a plain text. Instead, the `MESSAGE` part contains a data structure that requires additional parsing.

The `panos-parser()` of AxoSyslog solves this problem, and can separate PAN-OS log messages to name-value pairs. For details on using value-pairs in AxoSyslog, see [Structuring macros, metadata, and other value-pairs](../../docs/axosyslog-core/chapter-concepts/concepts-value-pairs/index.md).

## Prerequisites

  * Version 3.29 of AxoSyslog or later.
  * PAN-OS log messages from Palo Alto Networks devices.



## Limitations

The `panos-parser()` only works on AxoSyslog version 3.29 or later.

## Configuration

You can include the `panos-parser()` in your AxoSyslog configuration like this:
```
 
       parser p_parser{
            panos-parser();
        };
    
```

To use this parser, the `scl.conf` file must be included in your AxoSyslog configuration:
```
 
       @include "scl.conf"
    
```

The `panos-parser()` is a reusable configuration snippet configured to parse Palo Alto Networks PAN-OS log messages. For details on using or writing such configuration snippets, see [Reusing configuration blocks](../../docs/axosyslog-core/chapter-configuration-file/large-configs/config-blocks/index.md). You can find the source of this configuration snippet on [GitHub](<https://github.com/axoflow/axosyslog/blob/master/scl/paloalto/panos.conf>).

* * *

[Message format parsed by panos-parser()](../../docs/axosyslog-core/chapter-parsers/panos-parser/panos-parser-m-form/index.md)

[PAN-OS parser options](../../docs/axosyslog-core/chapter-parsers/panos-parser/panos-parser-options/index.md)

Last modified June 4, 2024: [Link and platform support updates (a3807ec9)](<https://github.com/axoflow/axosyslog-core-docs/commit/a3807ec937fdab2f251a52daf2e9f2cb6afe0cd2>)