topic Re: Log Collections - I am confused in General Topics

Log Collections - I am confused

Alex_Samad — Tue, 27 Jun 2017 03:59:25 GMT

Okay I have pa-5220 - cluster and a single pa-850 and 1 panoram vm.

I would like to see all the log that i see by logging into the individual fw on the panorama interface.

So do I need to setup panorama as a log collector or do I setup log forwarding on the devices to point to panorama.

I'm currently try this

https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/manage-log-collection/configure-log-forwarding-to-panorama#_36159

came from

https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/panorama-overview/centralized-logging-and-reporting

But I also followed - before and unsuccessufly setup panorama as a log collector. I have add a new HD and converted the vm into panoram mode.

I have also removed the original drive as it has copied over all it needed.

But I didn't see any information under the monitor tab.

Re: Log Collections - I am confused

acc6d0b3610eec313831f7900fdbd235 — Tue, 27 Jun 2017 04:52:02 GMT

Hi @Alex_Samad

Just a quick question. Are you trying to set up the M-100 as Log Collector or the Panorama VM?

Notice that any platform can be a dedicated manager, but only M-Series can be a dedicated log collector.

Maybe these both articles will help you with some more information. I think it will be more interactive for you 🙂

https://live.paloaltonetworks.com/t5/Management-Articles/Panorama-Sizing-and-Design-Guide/ta-p/72181

https://live.paloaltonetworks.com/t5/Community-Blog/Upgrade-Panorama-logs-to-PAN-OS-8-0-FAQ/ba-p/154755

Let me know if it is useful.

Re: Log Collections - I am confused

Alex_Samad — Tue, 27 Jun 2017 05:02:29 GMT

Panorama VM into a Panorama and log Collector

Re: Log Collections - I am confused

acc6d0b3610eec313831f7900fdbd235 — Tue, 27 Jun 2017 05:05:31 GMT

Panorama VMs cannot be configured as a dedicated log collector, as per the article I sent previously. For Log collectors you need the Panorama M-100 instead.

Re: Log Collections - I am confused

Remo — Tue, 27 Jun 2017 05:12:26 GMT

on the panorama cli there are some checks to see the disk status ... (which I fist have to find 😛 )

but you should also see some stats in the WebUI.

And then a few questions: Did you push the configuration to the local log collector? Did you reboot the vm since you added the disk and pushed the configuration (little unconventional I know, but this helped when I was in the same situation as you)?

Re: Log Collections - I am confused

reaper — Tue, 27 Jun 2017 10:42:25 GMT

For the panorama VM you'll need to create a log forwarding profile on each firewall and enable it in all the security policies you want to log on panorama

since you have a single panorama VM you don't need to worry about creating log collectors etc as this is reserved for the management hardware

Re: Log Collections - I am confused

Alex_Samad — Thu, 29 Jun 2017 00:59:49 GMT

I have rebooted a few time

when i goto panorama / management / Logging and reporting settings my log storage is still only 13G ( I added a 300G HD)

But having said that when i goto panorama / managed collectors and select panorama then disks I see Disk Pair A there which is the 300G disk

On the managed collectors page its in sync and connected but stats shows me all 0's

Re: Log Collections - I am confused

Alex_Samad — Thu, 29 Jun 2017 01:02:28 GMT

Yeap so on panorama I have a device group - that encompasses all my devices and on objects / log forwarding

I have an entry with an entry for each type of log and filter is all and forward method is panorama

and I have select a couple of key policies and attached the log forwarding config using the above ..

But sill nothing