How to Extend Panorama Logs to Dedicated Log Disk

Details

By default, the Panorama Virtual Machine template provided by Palo Alto Networks firewall comes configured with a single disk, which hosts both the operating system and the logs collected from the associated firewalls. Shown below is an example of the VM configuration:

The following screenshot is an example of system disk-partition and disk-space:

The default disk provides 10 GB's of storage. If more storage is needed, a custom virtual disk can be attached to the VM and it will be used as a dedicated log disk.

Note: The maximum disk size is 2 TB's. With 8.0 the maximum size increases (24TB in the newer PAN-OS). For more info please see Panorama 8.10 admin guide.

Disk type needs to be SCSI, and the recommended VMWare disk provisioning is Thick Provision Lazy Zeroed, as shown in the example below:

After rebooting Panorama, the new partition and log disk size are visible by using the following CLI commands:

> show system disk-space
> show system disk-partition

Important notes:

• The total space allocated for log storage is the size of the attached virtual disk.
  For example, if attaching a 100GB disk the total log size will be 100 GB.
• Attach only one log disk to Panorama VM. If other disks are attached, they will be ignored. With 8.1 the behavior is different. Please see Panorama 8.1 admin guide
• Up until 8.0 disk size cannot be extended by modifying the disk size. If the disk size is modified, the allocated log database size remains the same as before. The actual disk size will be increased, but the partition size will not be increased by Panorama VM.