What is the deal with VM Panorama mode maximum log storage space?

[RMikalauskas]

Hello,

Documentation states that VM Panorama mode can support up to 24TB of log storage on a single virtual appliance.

Each logging disk has 2TB of storage capacity for a total maximum of 24TB on a single virtual appliance

So we add 12 virtual disks with 2TB of storage to the machine.

> show system disk details shows 12 disks with 2097152 MB of storage. Good.
> show system disk-partition is where things get confusing. PAN-OS creates 1.7TB partitions for each disk no matter what:

Disk /dev/sdb: 2199.0 GB, 2199023255552 bytes, 4294967296 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: gpt

# Start End Size Type Name
1 19531 3706898437 1.7T Microsoft basic primary

Disk /dev/sdc: 2199.0 GB, 2199023255552 bytes, 4294967296 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: gpt

What exactly is going on here? Why only a range of 9531 - 3706898437 sectors being used? Which effectively limits disk size to roughly 1.7TB.

So now we are left with 20,4TB of total storage, in theory (12 x 1.7).

However, when we create a Collector Group and select all 12 disks - it only shows Max: 18.38 TB of storage!

Can someone please explain what happens to the rest, almost 6TB of storage?

Thank you.

[BatD]

@RMikalauskas I also had the same issue and here is a detailed article explaining the reason for the discrepancies: 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5aCAC

[RMikalauskas]

I've read that article. It does not take into account that we are using virtual disks and not actual physical ones, where manufacturers count 1,000,000,000,000 bytes as a Terabyte. When we add 2TB disk in VMware - it is actually TB of size, or 2199023255552 bytes. As shown in PAN-OS itself.

Disk /dev/sdb: 2199.0 GB, 2199023255552 bytes, 4294967296 sectors

Units = sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk label type: gpt

#         Start          End    Size  Type            Name

1        20480   3706898431    1.7T  Microsoft basic primary

But for some reason it undersizes the partition and allocates only a range of 20480 - 3706898431 sectors, leaving us with 1897921510912 total bytes worth of storage. Which is actually 1.89 TB, not 1.7 TB. But I guess there is some overhead.

In any case - 588048385 sectors or ~300GB of storage goes "missing" after partitioning. That adds up to 3.6 TB of space if we add 12 drives. Significant, don't you think?

[BatD]

@RMikalauskas The point I was trying to make is that this is expected behaviour and not a fault. I agree it is misleading and is maybe you should raise it with you Palo Alto SE or Account manager.