topic Re: Reason Why Logs Are Received by SLS but Not Stored in General Topics

Reason Why Logs Are Received by SLS but Not Stored

ym-higashi — Tue, 03 Feb 2026 11:06:21 GMT

In Strata Logging Service, ACTUAL RETENTION DAYS was shown as 0 for certain log types (such as firewall_traffic).

Meanwhile, we observed that system and dns_security logs have increasing ACTUAL RETENTION DAYS.
I understanding is that when ACTUAL RETENTION DAYS is 0, it indicates that SLS is not retaining logs for that log type.
We have confirmed that CONFIGURED RETENTION DAYS is set to 366 days.
Additionally, the Dashboard → Incoming Logs Rate confirms that the firewall is successfully sending logs to SLS.
Why is SLS receiving these logs but not storing them?

Re: Reason Why Logs Are Received by SLS but Not Stored

BPry — Tue, 03 Feb 2026 18:59:38 GMT

@ym-higashi,

Do you actually have enough licenses to cover all of the devices and have you setup the association properly?

Re: Reason Why Logs Are Received by SLS but Not Stored

Brandon_Wertz — Thu, 05 Feb 2026 17:19:39 GMT

@ym-higashi wrote:

In Strata Logging Service, ACTUAL RETENTION DAYS was shown as 0 for certain log types (such as firewall_traffic).

Meanwhile, we observed that system and dns_security logs have increasing ACTUAL RETENTION DAYS.
I understanding is that when ACTUAL RETENTION DAYS is 0, it indicates that SLS is not retaining logs for that log type.
We have confirmed that CONFIGURED RETENTION DAYS is set to 366 days.
Additionally, the Dashboard → Incoming Logs Rate confirms that the firewall is successfully sending logs to SLS.
Why is SLS receiving these logs but not storing them?

I suspect there's something else going on. A while back maybe 2-4 months Palo Alto changed how they billed for SLS storage. Now customers just get a year, you shouldn't be paying for "X" amount of TBs anymore. This might be something you should bring up with your Palo account team.

As an example...there's no way we're paying for 1800 days for storage, but Palo has adjusted the product: