Loading log data into Panorama for Research and Investigations

[idt_neteng]

We archive old logs off of Panorama for safekeeping, but have a need to re-load some of this data back into a Panorama Appliance for investigation.  Has anyone had any experience with doing this, is it even possible to do without going under the hood?

[sdurga]

You can use the command "scp import logdb from host" from the cli of the panorama. This should let you import the logdb that you have archived earlier. Hope this helps.
Tx,
Sandeep

[idt_neteng]

Sandeep,

This is the case for logdb exports, what I'm dealing with here are log exports (threat,url, etc).  The DB exports are not useful generally because they are not readable by log management systems.  About the closest we have right now to this sort of analysis capability is the "palo alto splunk app" which leaves much to be desired.  I prefer to load and manage this directly in a Panorama analysis engine.

[bvandivier · Accepted solution]

Hello, per the following Knowledge Point post you can import logs into Panorama with one caveat: any existing logs will be deleted by the newly imported logs.

https://live.paloaltonetworks.com/message/10810

I recommend either increasing the storage capacity of your Panorama implementation so you will have access to all required logs or perhaps discuss a feature enhancement with your local Palo Alto Systems Engineer.