Logs from secondary Panorama

Goutham — Fri, 01 Apr 2022 05:19:52 GMT

Hello Team,

We are having two panorama's configured in HA. As of now all the traffic is been handled by Primary Panorama and secondary is on handby. Now can we use the secondary panorama for log collection to decrease the CPU on primary?

if so kindly let us know how ?

Re: Logs from secondary Panorama

PavelK — Fri, 01 Apr 2022 23:11:07 GMT

Thank you for the post @Goutham

the scenario you mentioned is described in this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBw7CAG&lang=en_US%E2%80%A9 Please refer to section: Collector Group Preference List

In nutshell, you will have to make sure that both log collectors (Primary and Secondary Panorama) are in the same log collector group, then you can configure log forwarding preference. Under log forwarding preference, you can for example split all your Firewalls into two lists. First half of the Firewalls will be ingesting logs by Primary Panorama (Secondary Panorama can be second in the list in the case Primary one is down). The second half of Firewalls will be ingesting logs by Secondary Panorama (Primary Panorama can be second in the list in the case Secondary one is down).

In this case, you decrease resource utilization on Primary Panorama by splitting load.

Here is a reference to documentation how to configure it: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-log-collection/manage-collector-groups/configure-a-collector-group.html

Kind Regards

Pavel

topic Logs from secondary Panorama in Panorama Discussions

Logs from secondary Panorama

Re: Logs from secondary Panorama