Domain 6 of the PCNSE exam tests your ability to use the firewall and Panorama to monitor traffic, generate logs, and create reports. Monitoring, logging, and reporting are the trio of tools that allow a network security engineer to see what is happening, investigate problems, and prove compliance. Without them, you are flying blind, and the exam expects you to know not just what each feature does, but exactly where to find it and how to configure it.
Jump to a section
A simple way to picture Monitoring, Logging, and Reporting
A busy restaurant's kitchen ticket system is the exact same thing as network monitoring, logging, and reporting. Every ticket that comes in is a session request. The kitchen printer is the traffic log. The head chef reviewing tickets to see which ingredients are running low is the security administrator looking at logs to spot a traffic spike. The weekly spreadsheet of how many steaks were sold is the report.
The ticket itself is a log entry. It records the table number (source IP), what was ordered (destination IP and port), whether the order was completed or sent back (action taken), and the time it was fired (timestamp). The chef never memorises each ticket, they just act on it and let the printer pile up. That is logging. If the chef has a problem, they go through the pile of tickets to find the one that matches the complaint. That is monitoring. At the end of the month, the owner asks for a report on which menu items are ordered most often. That is reporting.
If the printer jams, the chef loses tickets and orders get missed. Same as when a firewall runs out of log storage. If the chef only looks at tickets when a customer complains, they react instead of preventing problems. Same as an IT team that only checks logs after a breach. The system is only useful if someone actually uses it.
In the world of Palo Alto Networks firewalls, monitoring, logging, and reporting are the three pillars that let you see what your network is doing. They are not the same thing, but they work together like a security camera system.
Logging is the act of recording events. Every time a packet hits the firewall, the firewall can choose to write a log entry. That entry contains details like the source IP address (the computer that sent the traffic), the destination IP address (the server being reached), the port number (which application service is being used, like web traffic on port 80), the action taken (allowed or blocked), and the timestamp. A log is a raw, unfiltered record. It is like a security camera that records everything in the corridor 24/7.
Monitoring is the act of actively looking at logs and real-time data to spot problems as they happen. You are not just storing logs, you are watching them. On a Palo Alto firewall, this means using the Monitor tab. You can see live traffic, search for specific sessions, and set up alerts when certain conditions are met. Continuing the camera analogy, monitoring is the security guard actually watching the live feed and noticing someone is loitering outside.
Reporting is the act of summarising log data over a period of time. A report shows trends. For example: "How many connection attempts happened from outside the network last week?" or "Which users accessed Facebook most often this month?" Reports are pre-built or customisable. They turn raw logs into business intelligence. The security guard writes a weekly report that says "between Monday and Friday, three people entered the building after 10pm."
A Palo Alto Networks firewall generates many types of logs. The main ones you need to know for PCNSE are:
Traffic Logs: Every session that passes through the firewall. This includes allowed and blocked traffic. You can see the source, destination, application, action, and bytes sent.
Threat Logs: When the firewall detects a threat (malware, exploit, phishing) in traffic. These logs show what the threat was and what action the firewall took (alert, block, or reset).
URL Filtering Logs: When the firewall blocks or allows access to a website based on its category (e.g., social media, gambling, malware).
System Logs: Events related to the firewall itself, like reboots, configuration changes, license expirations.
Configuration Logs: Who changed what setting in the firewall and when. This is crucial for auditing.
User-ID Logs: Events related to user identification, like when a user logs in or is mapped to an IP address.
Why does this matter? Because a firewall that only blocks traffic and never tells you what it blocked is not doing its full job. Logging provides accountability. Monitoring provides real-time awareness. Reporting provides long-term visibility. In a business context, you need logs to prove to auditors that you are blocking malware. You need monitoring to catch an ongoing attack. You need reports to justify why you need a bigger firewall.
Panorama is the central management system that collects logs from multiple firewalls. Instead of logging into each firewall separately, you can see all logs in one place. Panorama also does centralised reporting across all your firewalls. If you have 50 firewalls across the world, you can generate a report on all of them from one dashboard. That is the power of Panorama for logging and reporting.
On the firewall itself, you find logs under the Monitor tab. The Monitor tab has sub-tabs for each log type. You can filter logs by time range, source IP, destination, application, and many other fields. You can also set up log forwarding to send logs to an external server like a SIEM (Security Information and Event Management) system, which is a separate platform that collects logs from many sources to correlate and analyse them.
Log storage is finite. The firewall has a hard drive that fills up. You must configure log retention settings. If you do not, old logs will be overwritten. Reporting is powered by the log database. If you delete logs or run out of space, your reports will be inaccurate. The exam will test you on where to configure log storage and retention.
In summary: logging records, monitoring observes, reporting summarises. Each has a specific place in the Palo Alto interface, and each has a specific purpose in network security.
Access the Monitor Tab
Log into the firewall web interface. Click on the 'Monitor' tab at the top. This is the central place for all log viewing, real-time traffic, and report generation. Without this step, you cannot see any logs.
Select the Correct Log Type
Under Monitor > Logs, choose the log type relevant to your investigation. For traffic analysis, choose 'Traffic'. For malware detection, choose 'Threat'. The exam tests that you know which log type matches which event.
Apply Filters to Find Specific Data
Use the filter bar at the top of the log view. You can filter by source IP, destination IP, application, action (allow/deny), and time range. For example, type 'addr.src in 10.0.0.5' to see all traffic from that IP. This narrows down millions of logs to exactly what you need.
Create a Log Forwarding Profile
Go to Objects > Log Forwarding. Create a new profile. Choose which log types to forward (Threat, Traffic, etc.) and the destination (Panorama IP, SIEM server). This profile must then be attached to a Security policy rule under Policies > Security. Without this step, logs stay only on the firewall.
Generate a Custom Report
Go to Monitor > Reports. Click 'Add' to create a custom report. Select the log type you want to base the report on (usually Traffic or Threat). Choose the time range and the fields you want to display (e.g., source IP, destination, action). Name the report and save it. This gives you a printable summary for management or auditors.
Set Up Monitoring Alerts in Panorama
If using Panorama, go to Panorama > Log Collecting > Monitoring. Create alert rules that trigger when certain log conditions are met (e.g., 50 denied sessions from one IP in 5 minutes). Configure email notification. This makes monitoring proactive instead of reactive.
Review System Logs for Configuration Changes
Always check System Logs when troubleshooting unexpected behaviour. Filter by 'config' to see who changed what and when. This step is often missed by beginners but is crucial for root cause analysis.
Imagine you are the sole IT person for a mid-sized company with 200 employees. One morning, the CEO calls you and says "I cannot access our customer database. It was working yesterday. Fix it." You have no idea what is wrong. This is where monitoring, logging, and reporting save your day.
First, you log into the Palo Alto firewall and go to the Monitor tab. You look at the Traffic Logs. You filter by the CEO's IP address (which you look up in Active Directory) and the destination IP of the database server. You see that yesterday, the session was allowed. Today, the session is showing as "denied" with a reason of "application mismatch". The firewall is seeing the traffic as a database application, but the policy only allows SQL traffic on a specific port. The CEO's application is using a different port today because of an update.
Next, you look at the System Logs to see if any configuration changed overnight. You find a log entry at 2 AM showing that an automated security policy update changed the rule that governs database access. That is your root cause. Without logging, you would have no clue why the traffic was blocked.
Now you need to report on this incident. You generate a custom report showing all denied traffic to the database server over the last 24 hours. You filter by source IP (the CEO's machine) and the database server IP. The report shows 14 denied attempts. You present this to the CEO to explain the timeline.
Finally, you set up monitoring. You create a log forwarding profile that sends critical threat logs to your email. You also set up a Panorama alert rule that sends a notification if any denial happens to the database server outside of business hours. You are now proactively monitoring instead of reacting.
Step by step, what you did:
Accessed the Monitor tab on the firewall
Filtered Traffic Logs by CEO's source IP
Identified the denied action and reason
Checked System Logs for configuration changes
Found the automated policy update
Generated a custom report for the CEO
Created log forwarding for future alerts
This scenario is exactly what the PCNSE exam expects you to know how to do. Not just theory, but the practical steps inside the interface.
The PCNSE exam tests monitoring, logging, and reporting heavily because they are daily tasks for a security engineer. Expect around 8-12 questions from this domain. The exam will not ask you to write a report, but it will test your knowledge of log types, where to find them, and how to configure log forwarding.
Here are the specific areas the exam loves:
Log Types and Their Locations:
- Traffic Logs: under Monitor > Logs > Traffic - Threat Logs: under Monitor > Logs > Threat - URL Filtering Logs: under Monitor > Logs > URL Filtering - System Logs: under Monitor > Logs > System - Configuration Logs: under Monitor > Logs > Config - User-ID Logs: under Monitor > Logs > User-ID You must memorise which log type is used for which purpose. A common exam question gives you a scenario and asks which log you would check first.
Log Forwarding and Profiles: You need to know how to create a Log Forwarding profile and attach it to a Security policy rule. The exam will present a scenario where logs are not being sent to a SIEM, and you must identify that the Log Forwarding profile was not applied to the rule.
Reports:
The exam distinguishes between predefined reports and custom reports.
You must know that reports are generated from the log database.
A common trap: reports can only be generated if logs exist for the time period. If the log database is full and logs were overwritten, the report will be incomplete.
Panorama vs Firewall Logging:
Panorama collects logs from multiple firewalls.
The exam will ask: if you have 10 firewalls and want a single report covering all, use Panorama.
If you want real-time monitoring of a single firewall, log into that firewall directly.
Log Storage and Retention:
The firewall has limited storage.
You can configure how long logs are kept.
The exam will test that logs are stored locally on the firewall and can be forwarded to Panorama or a SIEM.
Traps to watch for:
They will ask you to choose between "Monitor" tab and "Reports" tab. Logs are in Monitor. Reports are generated from logs but are a separate tab.
They will give a scenario where logs are not showing and the answer is "the log storage is full" or "the log forwarding profile is missing".
They will mix up log types: a URL filtering event goes in URL Filtering Logs, not Threat Logs.
They will ask about the difference between "alert" and "allow" actions in logs. Allowed traffic still produces a log. Denied traffic also produces a log. Both are in Traffic Logs.
Key definitions to memorise:
Session: a single flow of traffic (e.g., one web page load)
Log entry: a record of that session
Source IP: the computer that initiated the connection
Destination IP: the server being accessed
Action: allow, deny, drop, reset
Application: the specific app (e.g., Facebook, SQL, HTTPS)
If you know the location of each log type, how to filter logs, and how to forward them, you will pass these questions.
Logging records every session; monitoring watches those records in real time; reporting summarises them over time.
Traffic Logs, Threat Logs, URL Filtering Logs, System Logs, Configuration Logs, and User-ID Logs are the six main log types you must memorise for the exam.
Logs are stored locally on the firewall and have limited retention; configure log forwarding to Panorama or a SIEM to keep them longer.
A Log Forwarding profile must be attached to a Security policy rule for logs to be sent to an external destination.
The Monitor tab is where you view and filter logs; the Reports tab is where you create and view summaries of historical log data.
Panorama provides centralised logging and reporting for multiple firewalls; each firewall keeps its own local logs unless forwarded.
Reports are only as accurate as the log data they are based on; if logs are overwritten or deleted, the report will be incomplete.
Allowed traffic generates a log just like denied traffic; always check the action field in the Traffic Log to see what the firewall did.
These come up on the exam all the time. Here's how to tell them apart.
Traffic Logs
Records every allowed or denied session.
Contains basic fields: source, destination, port, action.
Used for general traffic analysis and capacity planning.
Threat Logs
Records only sessions where a threat is detected.
Contains threat-specific fields: signature ID, severity, direction.
Used for incident response and vulnerability analysis.
Monitoring
Involves watching live or recent log data.
Goal is to identify issues as they happen.
Uses filters and alerts in the Monitor tab.
Reporting
Involves generating summaries of historical log data.
Goal is to identify trends and provide evidence.
Uses the Reports tab with scheduled or ad hoc runs.
Firewall Local Logs
Stored locally on the firewall hard drive.
Limited retention based on available storage.
Viewed directly in the firewall's Monitor tab.
Panorama Centralised Logs
Stored on Panorama server after forwarding.
Much larger retention because Panorama has more storage.
Viewed in Panorama Monitor across multiple firewalls.
Predefined Reports
Created by Palo Alto; cannot be modified.
Cover common use cases like top applications or bandwidth.
Found under Monitor > Reports > Predefined.
Custom Reports
Created by the administrator from scratch.
Can specify any log fields, filters, and time ranges.
Found under Monitor > Reports > Custom.
Mistake
All logs are stored forever by default on the firewall.
Correct
Logs have a limited retention period set by the administrator. The firewall will overwrite old logs when storage runs out.
Beginners assume digital storage is infinite because they have large hard drives at home.
Mistake
If traffic is allowed by the firewall, no log is generated.
Correct
Allowed traffic still generates a Traffic Log entry. Every session produces a log unless logging is specifically disabled.
People think logs are only for problems, but network engineers need logs for auditing and capacity planning.
Mistake
Monitoring and logging are the exact same thing.
Correct
Logging is recording data. Monitoring is actively watching that data for changes. They are related but distinct functions.
The terms are used interchangeably in casual conversation, but the exam distinguishes them precisely.
Mistake
Reports are generated from the live traffic stream in real time.
Correct
Reports use historical log data stored in the database. They are not real time. You need to wait for logs to be written first.
Beginners confuse the Monitor tab's live traffic view with the Reports tab's historical summaries.
Mistake
Panorama logs are identical to firewall logs and stored in the same way.
Correct
Panorama receives logs forwarded from firewalls. It stores them in its own database. The two systems are separate.
Because Panorama shows logs from multiple firewalls, beginners think it just mirrors the firewall's storage.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Check the Configuration Logs under Monitor > Logs > Config. Filter by time range and administrator name. Each entry shows the exact change made and who made it.
Either the log storage is full and old logs were overwritten, or the Security policy rule that matched the traffic does not have logging enabled. Check the rule's 'Log at Session End' setting and the log forwarding profile.
A Traffic Log records every session (allowed or denied) with basic details like source, destination, and action. A Threat Log records only sessions where a threat was detected, like malware or exploit, and includes details about the threat.
Yes. Under Monitor, select 'Traffic' and then click the 'Live' icon (a circular arrow). This shows sessions as they happen. For historical traffic, you view the standard log view.
Create a Log Forwarding profile under Objects > Log Forwarding. Configure the destination server (SIEM IP and port) and the log types to forward. Then attach that profile to your Security policy rules.
The firewall will begin overwriting the oldest logs with new ones. You will lose historical data. To avoid this, configure log retention settings or forward logs to Panorama or a SIEM.
You've finished Monitoring, Logging, and Reporting. Continue through the PCNSE study guide to build a complete picture of the exam.
Done with this chapter?