topic Re: Panorama 8.0 log retention in General Topics

Panorama 8.0 log retention

Laurent_Dormond — Tue, 12 Jun 2018 07:28:26 GMT

Hello,

We recently upgraded our Panorama VM from PanOS 7.1 to PanOS 8.0, currently running 8.0.8.

After the upgrade and the migration process, we noticed that our traffic log retention capacity decreased to over a third (from around 100 days to around 30 days).

We had no change in our network also no reason thinking to have an increase of the overall network traffic.

Did you notice the same in your environment ?

Laurent

Re: Panorama 8.0 log retention

Remo — Tue, 12 Jun 2018 07:52:56 GMT

Hi @Laurent_Dormond

What do you mean with "recently upgraded"? Did you change from legacy to panorama mode? If yes, how much storage do you have attached to your VM and how many CPU/GB of RAM?

Re: Panorama 8.0 log retention

Laurent_Dormond — Tue, 12 Jun 2018 08:59:02 GMT

Hi vsys_remo,

We upgraded 3 months ago in 8.0.1 with migration from legacy mode to panorama mode. We added CPU and RAM as requested for that (8 vCPU and 16 GB RAM).

We have 2 TB for the storage VMFS (we didn't change it)

Regards,

Re: Panorama 8.0 log retention

Remo — Tue, 12 Jun 2018 09:13:16 GMT

Hi @Laurent_Dormond

Between legacy and panorama mode there were fundamental changes in the way the logs are stored, which could result in increased storage requirement but I am not aware of something like what you are seeing.

Do you log denied traffic to panorama, specially from the internet? This could result in ups and downs of the actual retention time.

Re: Panorama 8.0 log retention

BPry — Tue, 12 Jun 2018 12:51:32 GMT

@Laurent_Dormond,

Just FYI, you lost 4% of the total disk space by default as it's automatically allocated to Platform Logs, 3rd Party External Logs, and Databases; this may be one area where you can reclaim some disk space. As @Remo noted however it's more prudent to find out what exactly is generating these logs and if you actually need to maintain them. There could be very simple changes, such as DNS logs getting logged, that can take place because of a new policy or new network design that can cause overall logging to increase drastically.