topic Re: Log forwarding to Panorama in General Topics

Log forwarding to Panorama

aespinosa — Fri, 13 Jul 2018 07:16:23 GMT

Hi,

I have some problems with log forwarding from firewall to Panorama because it is consuming a lot of bandwidth. I have configured the firewall to buffer the logs before foward them to Panorama. I would like to know the following:
* When log forwarding initiates from firewall to Panorama (50% or 90% of buffered size for example)?
* How I control the log forwarding to schedule it during off business hours?

Anyone can help me?

Thanks in advance.

Re: Log forwarding to Panorama

reaper — Fri, 13 Jul 2018 14:03:46 GMT

hi @aespinosa

Log buffering is only intended for overcoming connectivity issues with panorama: if the firewall is in a location where connectivity to panorama can be spotty ?(due to ISP peering, remote location, bandwidth,...) enabling the buffer ensures no logs get lost when the connection to panorama is lost: the firewall temporarily writes to disk while connectivity is restored and then resumes from the last log in it's buffer

this works in 30 second increments

https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/manage-log-collection/modify-log-forwarding-and-buffering-defaults

you can try enabling log-suppression to reduce repetitive logs, bit to truly reduce bandwidth usage, you will need to dial down which logs are forwarded

Re: Log forwarding to Panorama

Remo — Sun, 15 Jul 2018 12:04:40 GMT

@aespinosa

If there is somewhere another firewall between the one mentionned in your post and your panorama, there might be another (ugly/bad/not recommended) solution. Depending on the actual amount of logs you could then only allow the connection between the firewall and panorama off business hours. As mentionned this only works if there is enough disk space to store the logs of the day. And this "solution" also means that you cannot manage the firewall from panorama during the day. And you will also loose the logs of one day completely if the firewall dies. So as I said its ugly to do it like that but this the logs are only forwarded outside business hours...