Issue with PA-1410 platform disk size

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Issue with PA-1410 platform disk size

L3 Networker

Hello Team,

                  Recently we have deployed PA-1410 in our datacenter and since first day we are having issue with disk space in loggin.

and after contacting the support, logging is not more than a week which is not accepted from our side.

I know that the PA-1410 disk is 128GB.

Did any one met with a similar issue? what was the solution ? is it available for paloalto to replace the HDD with anothe one with more space?

TIA

MR
9 REPLIES 9

L1 Bithead

Yes me to. I have less than a day. They really skimmed on the disk. which is BAAAD.

have you or they managed to solve it? how ? is it possible to replacethe HDD with more storage one ?

MR


@MRamadanAHafiez wrote:

have you or they managed to solve it? how ? is it possible to replacethe HDD with more storage one ?


Your only solve is a larger 1k appliance or move to the 3400, or use some type of external log storage (Panorama, CDL, SEIM.)  There's not a solve with the appliance model you have.

Cyber Elite
Cyber Elite

Keep in mind that a lot of people are replacing PA-3200 series hardware with the PA-1400 series. This makes sense as PAN didn't previously have an intermediate platform between the PA-800 and the PA-3200 series, but the replacement for the PA-3200 is the PA-3400. The PA-1400 series replaces the PA-800 and it doubles the storage available from its intended predecessor, the same way that the other newer platforms do. 

 

Your VAR/Partner likely did you a disservice by not mentioning the downgrade in storage that you'd be getting going with a smaller platform, but there's also a little bit of self-reflection that needs to go into that as well. The storage space available on each device isn't hidden information and would have been known if the question was asked prior to purchase. Since it wasn't asked, external log storage is the only real viable solution that you have going forward. 

Assuming that you have even an old desktop laying around somewhere, you could use something like Graylog to build a completely open-source solution for keeping logs longer. It would just cost you some time to get setup and configured. 

the PA 820 had 256GB, the step up the PA1410 only have 128 GB, where acording to my Firewalls only 18GB are used for logging, this is really nothing like dobbeling, predecessor.


@BPry wrote:

Keep in mind that a lot of people are replacing PA-3200 series hardware with the PA-1400 series. This makes sense as PAN didn't previously have an intermediate platform between the PA-800 and the PA-3200 series, but the replacement for the PA-3200 is the PA-3400. The PA-1400 series replaces the PA-800 and it doubles the storage available from its intended predecessor, the same way that the other newer platforms do. 

 

Your VAR/Partner likely did you a disservice by not mentioning the downgrade in storage that you'd be getting going with a smaller platform, but there's also a little bit of self-reflection that needs to go into that as well. The storage space available on each device isn't hidden information and would have been known if the question was asked prior to purchase. Since it wasn't asked, external log storage is the only real viable solution that you have going forward. 

Assuming that you have even an old desktop laying around somewhere, you could use something like Graylog to build a completely open-source solution for keeping logs longer. It would just cost you some time to get setup and configured. 


This hits the target.  Our Palo account team told us the 3200 replacement was the 3400, so that's what we went to.  The 1ks are no where near the 32/3400s.  I've heard a few stories where the 1ks are really under performing customer expectations because of the hardware limitations.  The 1k is probably a great box, but it needs to fit the deployment requirements.

L3 Networker

I will ask it frankly, is there away to replace the current har dsik with larger one?? 

We are thinking seriously of suspending the deployment.

If we have deployed panorama, will its syslog receiver stop if it was not licensed? Or it will keep on receiving the logs and reporting too even without licensing it?

MR

Cyber Elite
Cyber Elite

@MRamadanAHafiez,

The drive isn't user replaceable on the PA-1410, so you won't be able to just replace it like you can on some of the larger platforms like you could with something like the PA-3200 or PA-3400.

thanx, and what about " 

If we have deployed panorama, will its syslog receiver stop if it was not licensed? Or it will keep on receiving the logs and reporting too even without licensing it?"

MR
  • 1341 Views
  • 9 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!