topic Re: Logging - advise if CPU load same regardless of log export method HTTP(s) Syslog and Netflow log in General Topics

Logging - advise if CPU load same regardless of log export method HTTP(s) Syslog and Netflow logging

SergGur — Mon, 23 Nov 2020 19:56:39 GMT

Hello Experts,

I tried to find any information to assist with understanding if some log export protocols taxing CPU (Management and DP) more then others. Perhaps ones DP pass log events to MP it is for Management to package and ship the logs, therefore, as long as some rules has logging enabled, the DP load will be the same regardless of the protocol used.

1. Is there any information to help with estimates on additional CPU load for Syslog log destinations? What about HTTP log destinations?

2. Can I save some CPU using TCP vs UDP syslog? Any other fiddling? Obviously logging on session end only will generate 2x less log amount.

The platforms in question are 8xx and 30xx.

Regards Serg.

Some notes:

List of logging protocols from documentation - Use External Services for Monitoring
Point in time stats via "show running logging"
KB listing "platform limits" here - Panorama Sizing and Design Guide It is also referencing CLI tool - "To check the log rate of a single firewall, download the attached file named "Device.zip", unpack the zip file and reference the README.txt file for instructions. This package will query a single firewall over a specified period of time (you can choose how many samples) and give an average number of logs per second for that period. At minimum this script should be run for 24 consecutive hours on a business day."

Re: Logging - advise if CPU load same regardless of log export method HTTP(s) Syslog and Netflow log

reaper — Thu, 26 Nov 2020 15:02:00 GMT

only logging at session end has a greater multiplier than 2, as 'session start' will log each step a session takes, which could be 3-4 steps as sessions go from app-id to app-id, especially with ssl decryption involved, so don't use 'log at session start' unless you're temporarily troubleshooting or _really_ need all the logs

all logging generated on the firewall is sent to the management plane log disk, only there additional log forwarding is performed by the varlogrcvr, so log forwarding, regardles of protocol, causes load on the MP, not on the DP

some logging will be optimized compared to other, panorama logging will have the best performance as there is queueing and some mechanisms in place to trickle logs when needed, on other protocols your mileage may vary depending on the overhead ( udp > tcp > http )

Re: Logging - advise if CPU load same regardless of log export method HTTP(s) Syslog and Netflow log

SergGur — Thu, 26 Nov 2020 16:38:36 GMT

Sorry, with regards to "mileage may vary depending on the overhead ( udp > tcp > http )" - do you mean UDP takes most or less CPU cycles from MP?