Palo Alto - Pull Audit Comments

[RyanMBess]

Morning all,

Does anyone know how to pull the audit log from panorama or the FW?
rule.opstate.audit_comment.history() <- This pulls a reference to the AuditComentLog. What I'm trying to do is pull all the human readable audit comments.

Any help would be appreciated.

[shinmog]

Yes, if you want the audit comment history, you can use:

rule.opstate.audit_comment.history()

That returns a panos.policies.AuditCommentLog, which has the comment param. That function also has params you can pass in that will specify order and number of entries.

[RyanMBess]

so you first have to run rule.opstate.audit_comment.history() get that data then run panos.policies.auditcommentlog.comment(xxxxxxxx) to pull out a single human readable comment.

There's no way to just go and get all the human readable comments easily?

[RyanMBess]

in short i'm trying to pull all audit comments off each rule just like you can see from the Audit Comment Archive button on the rule within the FW or panorama.