topic Re: Panorama data detailed logs in General Topics

Panorama data detailed logs

ArunjitSingh — Mon, 13 Jul 2015 06:41:06 GMT

hi Team

Please tell how much time frame can detailed logs can retain e.g traffic on panorama before they start to purge to summary database?

or if panorama data detailed logs work differently please tell.?

Re: Panorama data detailed logs

pulukas — Mon, 13 Jul 2015 11:33:27 GMT

Logging is all based on available space rollover and not any summarization schedule. So how much you get is strictly a matter of the volume of logs generated and the averrable size of storage.

Re: Panorama data detailed logs

ArunjitSingh — Tue, 14 Jul 2015 00:33:26 GMT

I am having issue of generating Traffic Log report of particular vsys of firewall using panorama (detailed logs(slower) Panorama Data)

the report of a month period of time or longer span of time, when summary database panorama data is used, it generates reports and also with remote device Data.

where as (detailed logs(slower) Panorama Data) is not generating custom report for longer time span.

Is there any documentation regarding Detailed logs reporting for panorama.

Re: Panorama data detailed logs

jdelio — Mon, 20 Jul 2015 19:56:51 GMT

What I would be interested to know is if you are able to generate the same detailed traffic report for a time period of 1 month or shorter? as you say longer does not work.??

Re: Panorama data detailed logs

ArunjitSingh — Thu, 23 Jul 2015 03:50:33 GMT

yes one month or shorter detailed logs can be generated.

Is it possible to generate and keep detailed logs over 1 month period time.?

Re: Panorama data detailed logs

jdelio — Thu, 23 Jul 2015 15:13:36 GMT

As Steven Puluka stated:

"Logging is all based on available space rollover and not any summarization schedule. So how much you get is strictly a matter of the volume of logs generated and the averrable size of storage."

So, to answer your question.. it might be possible to perform this if the logs still contain the data.

If you were able to run 1 month, and have it work, but longer than a month has issues, then would it be possible to run 2 reports, but each one handles 1 month? Make a custom time, and see if that works for you, if possible.

There might also be issues with the source of the reporting for longer than a month.

If that is the case, then a support case needs to be opened for this.

Regards,

Joe Delio

Re: Panorama data detailed logs

pulukas — Thu, 23 Jul 2015 21:21:21 GMT

So to increase the length of time you have detailed logging you have two options that will help.

Assign Panorama a maximum sized logging partition.

Reduce the number of logs you generate by only logging rules and parameters you will use.