topic Re: Changing max logging rate to 50000 on VM-100 in General Topics

Changing max logging rate to 50000 on VM-100

hgiguelay — Tue, 20 Jun 2017 08:30:54 GMT

I followed the learning article What Units are used for Max-packet-rate and Max-log-rate?

on a PA VM-100:

admin@PA-VM> show system info
...
vm-license: VM-100
vm-mode: VMWare ESXi
sw-version: 8.0.3
...

And the max logging rate modification does not seem to work:

admin@PA-VM> show running logging
Max. logging rate: 1280 cnt/s
Max. packet logging rate: 2560 KB/s
Traffic log generation rate: 0 cnt/s
Threat log generation rate: 0 cnt/s
Log sent rate: 1280 cnt/s
Current traffic log count: 0 
Current threat log count: 0 
Random traffic log drop: off 
Log suppression: on
default-policy-logging: off

admin@PA-VM> configure
Entering configuration mode
[edit] 
admin@PA-VM# set deviceconfig setting logging max-log-rate 50000
[edit] 
admin@PA-VM# commit
 
Commit job 2 is in progress. Use Ctrl+C to return to command prompt
..55%98%........100%
Configuration committed successfully
[edit] 
admin@PA-VM# exit
Exiting configuration mode
admin@PA-VM> show system setting logging
Max. logging rate: 1280 cnt/s
Max. packet logging rate: 2560 KB/s
Traffic log generation rate: 0 cnt/s
Threat log generation rate: 0 cnt/s
Log sent rate: 1280 cnt/s
Current traffic log count: 0 
Current threat log count: 0 
Random traffic log drop: off 
Log suppression: on
default-policy-logging: off

After some ~~painful~~ dichotomy exercise 🙂 , I could find that the maximum value that I can set is somewhere between 6800 and 6900.

Any idea on this behavior?

Is the maximum value platform dependant? Any link to some doc?

Re: Changing max logging rate to 50000 on VM-100

acc6d0b3610eec313831f7900fdbd235 — Thu, 22 Jun 2017 05:19:35 GMT

Hi @hgiguelay

Although the below link is about the Panorama design it does provide the number of supported logs per second across each model.

https://live.paloaltonetworks.com/t5/Management-Articles/Panorama-Sizing-and-Design-Guide/ta-p/72181

According to the below table the VM-Series supports a maximum of 2,250 logs per second; hence, setting the logging rate to "50000" will not be supported.

I hope this helps

Re: Changing max logging rate to 50000 on VM-100

hgiguelay — Wed, 28 Jun 2017 09:09:34 GMT

Thanks a lot @acc6d0b3610eec313831f7900fdbd235 for pointing the references. However, the documented 2250 limitation contradicts the maximum logging rate value that I could set/test and validate: 6800.

Re: Changing max logging rate to 50000 on VM-100

reaper — Thu, 29 Jun 2017 11:11:40 GMT

please revisit the article, it was updated to reflect more flavors of VM