topic Log Retention for PA-1400 in Next-Generation Firewall Discussions

Log Retention for PA-1400

nuranisnadiah — Tue, 04 Jun 2024 04:28:54 GMT

Hi,

Specifically for PA-1420, I aware the storage capacity is 240GB. Is there anyway I can know the duration of log retention for 700 users?

From what I understand, log retention is affected by the space on disk, not on the number of user. When you run out of it, firewall will automatically deletes oldest entries in that specific log, whether it's traffic, threat, URL.

Is my understanding correct?

Re: Log Retention for PA-1400

reaper — Tue, 04 Jun 2024 11:40:51 GMT

log ingestion depends on many factors but the 'default' expectancy for a 1400 chassis is about 5tb for 30 days (so your 240gb will not get you far)

The logs are broken up into containers for each different log type (traffic, threat, ...) and log retention/pruning will be different for each container. once a container is full, logs will be pruned FIFO (oldest logs get deleted)

you are able to change the storage assigned to each container, so you are able to manipulate how much storage each type receives (e.g. if traffic log is less important than threat log, you could remove some storage % from traffic log container to reassign to the threat log container etc)

Re: Log Retention for PA-1400

OtakarKlier — Tue, 04 Jun 2024 16:31:14 GMT

Hello,

It would be best to send the logs to a SIEM for longer term storage. There are many 'free' and low cost options available.

Regards,