topic Log retention in firewalls and panorama in General Topics

Log retention in firewalls and panorama

mario.chancay — Mon, 30 Jan 2017 23:48:59 GMT

Hi, I have the following question related to log management:

why PAN-70X0 can't send event logs to Panorama ?
are the event logs stored in compressed format ? If so, what is the compression ratio ?

Regards

Mario

Re: Log retention in firewalls and panorama

VinceM — Tue, 31 Jan 2017 10:18:39 GMT

Hi,

For me 70xx plateform are provided with log collector then log are stored in.

You can't forward log directly to Panorama: https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/monitoring/configure-log-forwarding

look for architecture: https://www.paloaltonetworks.com/documentation/70/panorama/panorama_adminguide/manage-log-collection/log-collection-deployments.html

For me no compression. If you need to estimate disk capacity, look: https://www.paloaltonetworks.com/documentation/60/panorama/panorama_adminguide/set-up-panorama/determine-panorama-log-storage-requirements

Hope help.

Re: Log retention in firewalls and panorama

VinceM — Wed, 01 Feb 2017 08:49:34 GMT

Hi,

Just short add.

For log fowarding to Panorama directly, please look into the V8 release note ....

Rgds

Re: Log retention in firewalls and panorama

Brandon_Wertz — Sun, 05 Feb 2017 16:09:26 GMT

I was just gonna comment that.

I noticed in the PAN-OS 8.0 RNs that they support forwarding to Panorama...That being said. In a production enviornment you'll want to stay away from 8.0 for a while maybe until 8.0.3-5 depending upon how quickly the bugs get mitigated.

Re: Log retention in firewalls and panorama

Nate_Newman — Tue, 15 Jan 2019 17:21:09 GMT

Hi Vince,

I am reading that logs can be compressed on a PANOS 8.0 firewall. I can find no setting that says compress or gzip logs at all. The guide shows how to do it but when you look in the firewall there is no option to compress.

Not in Device > Log Settings, or Objects > Log Forwarding. I am using a PA-500 although the below article is regarding 7K. This would lead me to believe only the 7K has the capability.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClT3CAK

Line: "Pack and compress more logs on a given send block."

thank you,

Nate