topic Re: Panorama VM - looking up older logs takes a long time in General Topics

Panorama VM - looking up older logs takes a long time

gudmundur — Mon, 24 Oct 2016 06:42:53 GMT

We have a Panorama VM with a 2TB local disk

Looking up recent traffic logs takes a short time

But looking up older logs takes quite a bit longer

As an example it took 10 minutes to look up logs older than 2016/9/20 05:25:25

I used this as a filter ( time_generated leq '2016/9/20 05:25:25' )

When Panorama is working on filtering the logs I dont see any high cpu load.

Anyone else noticed this or found a solution ?

Re: Panorama VM - looking up older logs takes a long time

LCMember1959 — Mon, 24 Oct 2016 10:04:43 GMT

We started using Panorama a few months ago, and I see the same thing when searching through traffic logs for older entries. We use VMware and the host running Panorama has 4 vCPUs and 4 GB memory. Panorama version is 7.1.4-h2

Re: Panorama VM - looking up older logs takes a long time

gudmundur — Mon, 24 Oct 2016 10:06:57 GMT

We are also using VMWare , 8 GB memory and 4 vCPUs and 7.1.4-h2 , going to upgrade to 7.1.5 tonight.

Re: Panorama VM - looking up older logs takes a long time

jvalentine — Mon, 24 Oct 2016 19:09:53 GMT

Have you looked at the storage array that is backing the Panorama VM? You could potentially see a large difference in logging/reporting performance based on factors such as flash vs hdd, dedicated vs shared vs over-subscribed, etc.

Re: Panorama VM - looking up older logs takes a long time

LCMember1959 — Wed, 26 Oct 2016 13:10:08 GMT

Our Panorama server uses a volume on iSCSI storage (Dell Equallogic) with SAS disks. Everything else on the same storage solution works very fast, so I don't think that it's a bottleneck.

Re: Panorama VM - looking up older logs takes a long time

Brandon_Wertz — Wed, 26 Oct 2016 14:56:32 GMT

My company has a VM Pan with 2TB of storage as well and larger searches take minutes for me to run as well. From my previous SE I was told this is a known issue and if you're having lots of logs or storage that a VM PAN solution is not the way to go.

We log anywhere from 80,000,000 to 160,000,000 logs to our panorama daily. The management CPU is only ever around 10-20% but queries for greater than two weeks ago, especially for more than a day take 5+ minutes.

I think Palo's answer is going to be buy M100/500s and stack as needed. We just deal with it.