Limitted logging storage with Panorama Virtual Appliance?

[soporte.sia]

Hello,

Does anyone know if it is there any limitation about storage for logs on Panorama Virtual Appliance?

Thank you in advance for your answers,

Ainara.

[torm · Accepted solution]

The default installation of the VM has 10GB logging space. You can increase by adding a virtual disk, or mounting a NFS share.

Have a look in the admin guide

or deployment guide:

"By default, Panorama maintains internal storage for log files and statistical data. The default Panorama

installation is set up with a single disk partition for all data; 10 GB of space is allocated for log storage

on the partition. To support environments that require more storage space, you can select from two

options:

• Create a custom virtual disk up to 2TB for ESX or ESXi. For instructions, see “Adding a Virtual

Disk” on page 368.

or,

• Configure an external NFS data store. For instructions, see“Setting Up Storage Partitions” on

page 368."

[soporte.sia]

Hello Torm,

Thank you for your answer. I would like to make you another question related to this.

Using NFS, if I wanted to export an amount of old logs to another file system for saving space matters, what should I do? Would it be possible to re-import them so Panorama could manage them again?

I will explain it: If I have NFS as storage system for Panorama Virtual Appliance, and this NFS grows, maybe I would like to save one specific year's log in another HD/machine, etc. And maybe later I would like to check these old logs via Panorama. What I mean is if it would be possible to export and import logs files from this external storage system to the NFS through any command in Panorama.

Thank you so much in advance,

Ainara.

[torm]

Yes, it is possible re-import old log files. But you should be aware that importing logs deletes any existing logs in the db. The same thing has been discussed here:

One thing that could be possible is maybe to change between different NFS shares for each year. Haven't tested if this is possible, but I don't see why not. For example  "/nfs-server/2012" and "/nfs-server/2013". Changing between them  would require a reboot of Panorama. Maybe not a good solution though.

[Abs]

You may also want to look into external syslogging if you need to revisit the logs after an extended period of time.

A.

(Now shamelessly accepting the next 72 friend requests.)

[mschuricht]

@torm You can actually do what you are suggesting with saving the directories directly from the NFS mount and then changing the mount or moving the files back into the NFS mount so they are visible to Panorama for investigation. The only issue is that moving old files back into a actively logging Panorama will likely delete the old files when new logs arrive. The best approach here is to do this in a second offline investigation/lab Panorama which is not receiving logs.