Hey @jesuscano
Cheers for confirming that. Did you restart the log receiver service and did it resolve the issue?
From what I gather, this problem is caused by the send queue being filled up when attempting to forward logs to Panorama. This can be verified by looking at the netstat output "show netstat" and looking at the "Send Queue" column for a socket open on port 10000.
In Panorama, there are a few best practices that we can look at:
1. Has a log forwarding preference list been configured? Panorama -> Collector Groups -> Device Log Forwarding
2. Is "enable redundancy across log collectors" checked?
3. Is "Forward to all collectors in the preference list" checked?
If options two and three are enabled, without the use of the preference list, then all logs will just be sent to one LC, and this will then be copying the logs to the other LCs anyways - causing a lot of stress. At this point the Panorama will start to throttle logs and this is when you will notice the netstat queues increasing.
Cheers,
Luke.
