High Logging Rate

[RobertShawver]

As seen on Panorama > Managed Devices > Health I have a few firewalls that are always in the red with a 15-Day average over 15000.  What is the easiest way/best way to bring that down?  Is it even an issue?  Should the fix be on the Panorama side or FW side?

[aleksandar.astardzhiev]

Hi @RobertShawver ,

- The value will be red, if it is deviating, not because it is too high.

- If such logging rate is a problem or not - I would say really depends on your environment. What Panorama model are you using, how many firewalls are you managing with it and how many of those have high logging rate. If you use physical M-series appliance you can check supporte logging rate here - M-Series Appliance Interfaces (paloaltonetworks.com)

Here is also some table for supproted log rate - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clc8CAC for FW and Panorama.

- From my point of view 15 000log/sec average is alot...But again this really depends on your environment. And unfortunately the only "fix" would be to disable traffic logs for some of the rules. Usually guides and documentations suggest to disable traffic log for trusted infrastrcuture rules, like allow traffic to DNS, SNMP, ping. Check you have rules that log at start and end (which is really usefull for troubleshooting, but will create two log entries for single connection (probably even more, if application shift hit different rules)

Consider changing trusted URL categories from alert to allow.

Basically there are lots of ways to lower the log rate, but as you may guess involves of disabling somekind of logging.

[RobertShawver]

I guess maybe that is where some of my lack of understanding comes from, what causes it to be say 10,000 logs/sec not deviating to 10,000 logs/sec deviating?  Sometime it shows the same or higher rate but is not "red".