Palo alto panorama - Any advice on how we can deal with old logs?

[SachinGargNTT]

We would like to migrate logs from M100 to M200 – Could you please advise how to proceed?

M100 has 4x2 disks

M200 has 2x2 disks

M-100 appliance to an M-200 or M-600 appliance- I understood this from the below URL. Kindly correct if any change

Log migration is not supported. The M-100 appliance logging disk form factor is not supported on the M-200 and M-600 appliances.

URL ref is below:-

https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/set-up-panorama/transition-to-a-differ...

Any advice on how we can deal with old logs?

Due to our security restrictions, we should be able to keep them some minimum period of time.

If there are no options to migrate them to a new log-collector what would You suggest to have them available?

[Remo]

Hi @SachinGargNTT 

How long is the retention time of the existing M-100 appliance and how long is your company policy for the retention?

Actually on the link you provided, the solution is already written:

-----------------------------------------------

This procedure assumes you are no longer using the M-100 or M-500 appliance for device management or log collection. If you plan on using the decommissioned M-100 or M-500 appliance as a Dedicated Log Collector, a device management license is required on the M-100 or M-500 appliance. Without a device management license, you are unable to use the M-100 or M-500 as a Dedicated Log Collector.

You may still access existing log data at a later date if you do not plan on using the M-100 or M-500 appliance as a Dedicated Log Collector. After you have successfully migrate to the new M-Series appliance, power on the M-100 or M-500 appliance to query and generate reports from the Panorama web interface of the decommissioned M-Series appliance. Palo Alto Networks recommends reviewing the log retention policy before decommissioning the M-100 or M-500 appliance.

----------------------------‐-------------------------------

This means on your new appliance you can add the old log collector as a dedicated log collector that you use only for logqueries and not for writing new logs to it. This requires that the old appliance is still licensed otherwise you will not be able to continue to use it. Does this answer your question?

[SachinGargNTT]

Is there any other way to keep logs without having existing M100 all the time online (old log-collector)?

[Remo]

No, at least no easy way. You can also export all the logs manually from the monitor tab or create a script that fetches the logs over the API and write them to a place where you can access them when you need it.