collector group with redundancy not working properly

[Deepak25]

we have configured Panorama M200 in HA , configured managed collector with local log collector , configured collector group and added local log collector of both panorama,  redundancy is enabled in collector group (log forwarding preference is not configured.

Above configuration we have done to store same logs on both local log collector and enable redundancy So if complete Pri M200 box failed , we will have same logs in Sec M200 local log collector.

But as per configuration logging is not happening properly on secondary panorama , there is a difference in system dis-space utilization

Also we sec panorama log collector not receiving any log ( as per our requirement and redundancy conifg secondaryM200 also should store the logs)

is there any configuration issue , or the output in sec m200 is normal ? how we can check same logs are store or not in sec M200 ?

We are able to see same logs in both M200 webgui , as per my understanding its because of collector group config .

[MP18]

@Deepak25 

I do not think from sec M200 CLI you will see incoming logs.

Please read this 

If you select this option, each log in the Collector Group will have two copies and each copy will reside on a different Log Collector. This redundancy ensures that, if any one Log Collector becomes unavailable, no logs are lost: you can see all the logs forwarded to the Collector Group and run reports for all the log data. Log redundancy is available only if the Collector Group has multiple Log Collectors and each Log Collector has the same number of disks.

After you enable redundancy, Panorama redistributes the existing logs across all the Log Collectors, which can take hours for each terabyte of logs. During the redistribution process, the maximum logging rate is reduced. In the Panorama > Collector Groups page, the Log Redistribution State column indicates the completion status of the process as a percentage. All the Log Collectors for any particular Collector Group must be the same model: for example, all M-500 appliances or all Panorama virtual appliances.

Because enabling redundancy creates more logs, this configuration requires more storage capacity. Enabling redundancy doubles the log processing traffic in a Collector Group, which reduces its maximum logging rate by half, as each Log Collector must distribute a copy of each log it receives. (When a Collector Group runs out of space, it deletes older logs.)

Regards

[Deepak25]

Thank you for information.

I have read many articles to investigate on this issue. Due to differences in disk utilization we want to check logging on sec m200. Also redistribution state is already completed and status is none when we deployed sec m200 in HA with pri M200 five month back. Due to pci standard logging is very important for us. 

[MP18]

@Deepak25 

So you mean you added sec M200 after few months to Primary M200 right?

We also have M200 in HA mode.

When I do shutdown of Primary M200 then Sec M200 becomes Primary and I can see old traffic logs there.

This tells me that logs are in syn between both.

Regards

[Deepak25]

Yes, we have deployed pri m200 in 2019 and due to pci standard we have added secondary panorama in 2020. 

Hv u configured same setting , can u please share your settings