topic Re: Panorama Firewall logs in Panorama Discussions

Panorama Firewall logs

Ramakrishnan — Mon, 01 Jul 2024 16:20:23 GMT

Dear All,

I currently manage two M-300 Panorama devices in Active/Standby mode, each with a full disk capacity of 4x4 TB (16 TB each). My firewall logs are forwarded to the Active Panorama. Estimated log lps we need at least 93 TB of storage to store 14-15 days of logs, as we do not have that capacity at current Panorama deployment. Due to this storage limitation we planning to have the logs at least for 10 days in Panorama. So we are planning to forward the logs SIEM or Cloud solution to maintain log retention as per policy. But our SIEM and/or Cloud platform aren’t ready yet, also I’m concerned that excessive logs could impact Panorama..?

To address this, I’d like to configure Panorama to retain logs for 10 days instead of storage capacity quota . Could you please guide me on how to achieve this setting logs based on days, after the days are reached panorama should continue to work, should not impact the performance. Can you please help me?

Re: Panorama Firewall logs

reaper — Tue, 02 Jul 2024 08:32:17 GMT

Hi!

Panorama will automatically purge old logs (FIFO) once log capacity is reached, so you shouldn't worry about performance

You can set maximum retention days in Panorama > collector group > group > General > Log storage

Re: Panorama Firewall logs

Ramakrishnan — Tue, 02 Jul 2024 13:33:39 GMT

Thanks @reaper for the swift reply.

When i call out Panorama LPS & storage, its a two fold issues. One is logs storage, that we can some how manage by limiting the no of days another issue is excess of LPS.

Yes, perhaps that setting maximum days its start rotate the logs, that ensure we will not hit storage overflow and missing of logs.

But I am concerned about the Panorama performance because, M-300 has the maximum of LPS into process up to 10K LPS, when I do the estimation its almost 48K LPS [about 400 firewalls] . If I am sending the more that 10K LPS will that process, store and rotate the logs or will Panorama ger chocked.

Re: Panorama Firewall logs

Ramakrishnan — Tue, 02 Jul 2024 16:19:45 GMT

Hi,

I have addition question regarding to checking the disk storage utilizing by logs.

show system logdb-quota

Slot:0

Quotas:

detailed: 60.00%, 1200 GB Expiration-period: 0 days

summary: 30.00%, 600 GB Expiration-period: 0 days

infra_audit: 5.00%, 100 GB Expiration-period: 0 days

platform: 0.10%, 2 GB Expiration-period: 0 days

external: 0.10%, 2 GB Expiration-period: 0 days

Disk usage:

detailed: Logs: 53300 MB, Current Retention: 69 days

summary: Logs: 3269 MB, Current Retention: 69 days

infra_audit: Logs: 0 MB, Current Retention: 0 days

platform: Logs: 0 MB, Current Retention: 0 days

external: Logs: 0 MB, Current Retention: 0 days

Slot:1

Quotas:

detailed: 60.00%, 1200 GB Expiration-period: 0 days

summary: 30.00%, 600 GB Expiration-period: 0 days

infra_audit: 5.00%, 100 GB Expiration-period: 0 days

platform: 0.10%, 2 GB Expiration-period: 0 days

external: 0.10%, 2 GB Expiration-period: 0 days

Disk usage:

detailed: Logs: 17683 MB, Current Retention: 69 days

summary: Logs: 1081 MB, Current Retention: 69 days

infra_audit: Logs: 0 MB, Current Retention: 0 days

platform: Logs: 0 MB, Current Retention: 0 days

external: Logs: 0 MB, Current Retention: 0 days

But in the the collector group showing only 1 TB is free out of 26 TB I could not get it. Can you please help me to understand.

Also to monitor the lps is there any command from the Panorama system rather than the estimator tool

Re: Panorama Firewall logs

Ramakrishnan — Wed, 03 Jul 2024 06:20:31 GMT

Some one can help me on this?

Re: Panorama Firewall logs

Ramakrishnan — Mon, 08 Jul 2024 12:34:49 GMT

@reaper Can some one explain me about the storage?