topic Loading log data into Panorama for Research and Investigations in General Topics

Loading log data into Panorama for Research and Investigations

idt_neteng — Mon, 20 Feb 2012 05:06:47 GMT

We archive old logs off of Panorama for safekeeping, but have a need to re-load some of this data back into a Panorama Appliance for investigation. Has anyone had any experience with doing this, is it even possible to do without going under the hood?

Re: Loading log data into Panorama for Research and Investigations

sdurga — Fri, 24 Feb 2012 04:49:10 GMT

You can use the command "scp import logdb from host" from the cli of the panorama. This should let you import the logdb that you have archived earlier. Hope this helps.
Tx,
Sandeep

Re: Loading log data into Panorama for Research and Investigations

idt_neteng — Fri, 24 Feb 2012 04:54:17 GMT

Sandeep,

This is the case for logdb exports, what I'm dealing with here are log exports (threat,url, etc). The DB exports are not useful generally because they are not readable by log management systems. About the closest we have right now to this sort of analysis capability is the "palo alto splunk app" which leaves much to be desired. I prefer to load and manage this directly in a Panorama analysis engine.

Re: Loading log data into Panorama for Research and Investigations

bvandivier — Sat, 25 Feb 2012 16:54:10 GMT

Hello, per the following Knowledge Point post you can import logs into Panorama with one caveat: any existing logs will be deleted by the newly imported logs.

https://live.paloaltonetworks.com/message/10810

I recommend either increasing the storage capacity of your Panorama implementation so you will have access to all required logs or perhaps discuss a feature enhancement with your local Palo Alto Systems Engineer.