topic Re: FW Logging Prefix list in General Topics

FW Logging Prefix list

Sanssj — Wed, 15 Aug 2018 00:39:16 GMT

Can any one confirm that when we configured log collector group with two managed log collector (both active and passive Panorama's) and if see the logging status on the firewalls does it show only the Active Log collector or both Active and Passive log collector.

thanks

Re: FW Logging Prefix list

BPry — Wed, 15 Aug 2018 12:45:52 GMT

@Sanssj,

Why are you putting the passive Panorama instance in as a log collector? Your firewalls will never connect to the passive Panorama, and as soon as the Panorama HA members switch the firewalls would still be connecting to the 'active' Panorama instance with all of the 'active' members information.

Re: FW Logging Prefix list

Sanssj — Wed, 15 Aug 2018 22:01:39 GMT

Its for log redundancy purpose.
So according to this deployment
https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/manage-log-collection/log-collection-deployments/deploy-panorama-m-series-appliances-with-local-log-collectors#id48ef20e9-5931-4ad9-8f4c-fe802fea558b

According to the above deployment at any given time FW’s should be sending the logs to both the local log collectors irrespective its active or passive.

But I agree with what u said i.e. the FWs will connected to only one of the local log collectors (active) and if that fails then FWs send the logs to the next available log collector in the device log preference list.

I just what to know why is this discrepancy.