09-30-2024 04:12 AM
Hello Team,
Recently we have deployed PA-1410 in our datacenter and since first day we are having issue with disk space in loggin.
and after contacting the support, logging is not more than a week which is not accepted from our side.
I know that the PA-1410 disk is 128GB.
Did any one met with a similar issue? what was the solution ? is it available for paloalto to replace the HDD with anothe one with more space?
TIA
09-30-2024 10:44 PM
have you or they managed to solve it? how ? is it possible to replacethe HDD with more storage one ?
10-01-2024 06:24 AM
@MRamadanAHafiez wrote:
have you or they managed to solve it? how ? is it possible to replacethe HDD with more storage one ?
Your only solve is a larger 1k appliance or move to the 3400, or use some type of external log storage (Panorama, CDL, SEIM.) There's not a solve with the appliance model you have.
10-01-2024 05:37 PM
Keep in mind that a lot of people are replacing PA-3200 series hardware with the PA-1400 series. This makes sense as PAN didn't previously have an intermediate platform between the PA-800 and the PA-3200 series, but the replacement for the PA-3200 is the PA-3400. The PA-1400 series replaces the PA-800 and it doubles the storage available from its intended predecessor, the same way that the other newer platforms do.
Your VAR/Partner likely did you a disservice by not mentioning the downgrade in storage that you'd be getting going with a smaller platform, but there's also a little bit of self-reflection that needs to go into that as well. The storage space available on each device isn't hidden information and would have been known if the question was asked prior to purchase. Since it wasn't asked, external log storage is the only real viable solution that you have going forward.
Assuming that you have even an old desktop laying around somewhere, you could use something like Graylog to build a completely open-source solution for keeping logs longer. It would just cost you some time to get setup and configured.
10-02-2024 01:53 AM
the PA 820 had 256GB, the step up the PA1410 only have 128 GB, where acording to my Firewalls only 18GB are used for logging, this is really nothing like dobbeling, predecessor.
10-02-2024 08:53 AM
@BPry wrote:
Keep in mind that a lot of people are replacing PA-3200 series hardware with the PA-1400 series. This makes sense as PAN didn't previously have an intermediate platform between the PA-800 and the PA-3200 series, but the replacement for the PA-3200 is the PA-3400. The PA-1400 series replaces the PA-800 and it doubles the storage available from its intended predecessor, the same way that the other newer platforms do.
Your VAR/Partner likely did you a disservice by not mentioning the downgrade in storage that you'd be getting going with a smaller platform, but there's also a little bit of self-reflection that needs to go into that as well. The storage space available on each device isn't hidden information and would have been known if the question was asked prior to purchase. Since it wasn't asked, external log storage is the only real viable solution that you have going forward.
Assuming that you have even an old desktop laying around somewhere, you could use something like Graylog to build a completely open-source solution for keeping logs longer. It would just cost you some time to get setup and configured.
This hits the target. Our Palo account team told us the 3200 replacement was the 3400, so that's what we went to. The 1ks are no where near the 32/3400s. I've heard a few stories where the 1ks are really under performing customer expectations because of the hardware limitations. The 1k is probably a great box, but it needs to fit the deployment requirements.
10-03-2024 10:01 AM - edited 10-03-2024 10:08 AM
I will ask it frankly, is there away to replace the current har dsik with larger one??
We are thinking seriously of suspending the deployment.
If we have deployed panorama, will its syslog receiver stop if it was not licensed? Or it will keep on receiving the logs and reporting too even without licensing it?
10-03-2024 10:05 AM
The drive isn't user replaceable on the PA-1410, so you won't be able to just replace it like you can on some of the larger platforms like you could with something like the PA-3200 or PA-3400.
10-03-2024 10:38 AM
thanx, and what about "
If we have deployed panorama, will its syslog receiver stop if it was not licensed? Or it will keep on receiving the logs and reporting too even without licensing it?"
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
