topic Re: Panorama Log Storage Calculation in General Topics

Panorama Log Storage Calculation

s.williams1 — Mon, 30 Oct 2017 11:50:34 GMT

Ok so I guess my logs dont even collect for 24 hours due to my log storage being about 7GB. Silly people who set this up I swear. So I am trying to figure out how much I do need.

I have a PA-500, PA-820, PA-3050 (x2, they are HA pair) and a PA-3020.

https://live.paloaltonetworks.com/t5/Management-Articles/Panorama-Sizing-and-Design-Guide/ta-p/72181

Now this article shows how many logs per second, but how do I determine what my log collection per day is? I assume its based on what logs I am collection and what sev level correct?

Re: Panorama Log Storage Calculation

Kaje — Mon, 30 Oct 2017 19:42:46 GMT

yes it does. Having an logging enviroment with alot of quick sesions, will fill that up a lot quicker than an enviroemtn with not many sesions that move alot of data.

for my enviroment 500gb is a bit over a month of data. 120gb was around a week, but we log every rule, and have multiple DMZ zones.

If you are running in legacy mode, you can only have 1 dedicated log disk, and if you need to change it, you loose all logs and start over. if you are running in "panorama" mode you have more flexabiltiy to add or remove disks.

https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/panorama-overview/panorama-models

I believe in a normal install, loging is part of the install disk, so you can easly add a dedicated disk easly without losing logs in any mode.

Re: Panorama Log Storage Calculation

s.williams1 — Mon, 30 Oct 2017 19:45:37 GMT

legacy mode vs Panorama mode? I am not sure what the differences are or how I tell?

Re: Panorama Log Storage Calculation

Kaje — Mon, 30 Oct 2017 19:49:56 GMT

Most likely you are in legacy mode,.. Panorama has some steep CPU requirements. (24 I beleive)

to check the mode you are in, from a SSH sesion run the following command.

> show system info

at the bottom you should see this line,

platform-family: pc
system-mode: legacy
operational-mode: normal
num-cpus: 4
ram-in-gb: 4

Re: Panorama Log Storage Calculation

s.williams1 — Wed, 01 Nov 2017 12:11:02 GMT

Yes, says legacy. With that what is the difference though? Do I get less features with legacy mode?

Re: Panorama Log Storage Calculation

Kaje — Wed, 01 Nov 2017 12:14:13 GMT

Here is a link with the diffrences.

https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/panorama-overview/panorama-models

mostly its just the volume of logs, and the size of disk supported. (8TB vs 24TB)

Do you have a single install disk on your VM, or two?

Re: Panorama Log Storage Calculation

s.williams1 — Wed, 01 Nov 2017 12:16:07 GMT

Is there anyway to figure this out through CLI? I do not have any visibility into vCenter being the Network guy...::insert eye roll emoji here::

Re: Panorama Log Storage Calculation

Kaje — Wed, 01 Nov 2017 12:23:29 GMT

In the CLI you can run the command

show system disk-space

the disks will start with sda, then the second will be sdb. if you have an sdb than you do have an dedicated log disk.

you can also do a

show system disk-partition

to see the partion sizes.

Re: Panorama Log Storage Calculation

s.williams1 — Wed, 01 Nov 2017 12:28:55 GMT

Looks like one disk currently.

Filesystem Size Used Avail Use% Mounted on
/dev/sda2 4.0G 2.4G 1.5G 62% /
/dev/sda5 24G 6.4G 17G 29% /opt/pancfg
/dev/sda6 4.0G 2.4G 1.4G 64% /opt/panrepo
tmpfs 2.0G 110M 1.9G 6% /dev/shm
cgroup_root 2.0G 0 2.0G 0% /cgroup
/dev/sda8 12G 5.0G 6.4G 44% /opt/panlogs

Re: Panorama Log Storage Calculation

Kaje — Wed, 01 Nov 2017 13:22:14 GMT

Looks like it will be easy. you just need to add a disk, and your logs will be automaticly moved over.

https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/set-up-panorama/set-up-the-panorama-virtual-appliance/expand-log-storage-capacity-on-the-panorama-virtual-appliance/add-a-virtual-disk-to-panorama-on-an-esxi-server

Re: Panorama Log Storage Calculation

s.williams1 — Wed, 01 Nov 2017 13:23:44 GMT

I just need to figure out how much space I need. Any tips trying to "guesstimate" that?

Re: Panorama Log Storage Calculation

Kaje — Wed, 01 Nov 2017 13:28:19 GMT

I can give you a guess,.. the document you linked has the best info.

But how much bandwidth do you puch thought the device? do you log everything? how about how many Zones do you have?

I personaly wouldnt want less then 100gb.. storage is cheap these days and most server VM enviroments should be able to support that without batting an eye. Just a guess without knowing the enviroment, and the amount of gear you listed. I would want at least 500gb, 750 to 1tb would be a dream, but thats a fight you got to have with your server guys!