Re: Palo Alto config with LEM

I would choose something like Local3 rather than log_user. You can use the checklogs command to see if the logs are reaching LEM

http://knowledgebase.solarwinds.com/kb/questions/3437/Using+the+CMC+%22checklogs%22+command

if you log to local3, use /var/log/local3.log. if you log it to local2, file path would be /var/log/local2.log