topic Re: logs on PA-2050 in General Topics

logs on PA-2050

bryanpascal — Wed, 19 Oct 2011 07:04:09 GMT

Hello everyone ,

I have recently implement pa-2050 at a customer premises. Nine days after the implementation each time when login on the web interface a system alarm just popup saying '' Database traffic exceeds percentage limited '' . Have a question , with the default quota for the traffic log how many days pa device can keep the logs?

Please find attached screenshot of the system alarm!

Regards,

B.P

Re: logs on PA-2050

schiang1 — Wed, 19 Oct 2011 15:26:53 GMT

There is a 160gb hard drive on the PA-2050. The number of days would depend on how much traffic is passing through the box and the size of the logs. The logs fill the disk and when nearly full, the PAN deletes the older logs.

These alerts are associated with the default Disk Quota settings/thresholds set (Under Device Tab->'Edit Session Management'):

In a nutshell:

- The Traffic Disk Quota is set @ 38.123 GB

- The Alarm Threshold is set @ 90% of 38.123GB, which = 34.3107GB (MB equivalent being 39037MB)

- The Traffic DB Disk allocates 38.9GB for Logs & Index, which (if fully utilized) exceeds the 90% threshold associated with the Disk Quota @ 38.123GB. (Though this actual # fluctuates following log purges)

there is a bug fix in the works regarding this particular alert/threshold comparison which should be available in upcoming release

Re: logs on PA-2050

paloalto_exn — Thu, 20 Oct 2011 14:36:53 GMT

Should I safely ignore it? Does it impact with the firewall operations?

Regards.

Walter

Re: logs on PA-2050

jleung — Sun, 23 Oct 2011 06:48:17 GMT

Hi,

That's fine, and we rotate the log automatically.

Regards,

Jones

Re: logs on PA-2050

oschuler — Sat, 17 Aug 2013 16:55:18 GMT

Could it be that this bug is still present in v5.0.5? As we're logging to Panorama anyway, we don't really care about the utilization of the logs on the boxes. However, it's frustrating when you login on the Web UI and you have to check every single alarm to ack it. At least a select all button would be fine...