Panorama VM - looking up older logs takes a long time

[gudmundur]

We have a Panorama VM with a 2TB local disk 

Looking up recent traffic logs takes a short time

But looking up older logs takes quite a bit longer 

As an example it took 10 minutes to look up logs older than 2016/9/20 05:25:25

I used this as a filter ( time_generated leq '2016/9/20 05:25:25' )

When Panorama is working on filtering the logs I dont see any high cpu load.

Anyone else noticed this or found a solution  ?

[LCMember1959]

We started using Panorama a few months ago, and I see the same thing when searching through traffic logs for older entries. We use VMware and the host running Panorama has 4 vCPUs and 4 GB memory. Panorama version is 7.1.4-h2

[gudmundur]

We are also using VMWare , 8 GB memory and 4 vCPUs and 7.1.4-h2 , going to upgrade to 7.1.5 tonight.

[jvalentine]

Have you looked at the storage array that is backing the Panorama VM?  You could potentially see a large difference in logging/reporting performance based on factors such as flash vs hdd, dedicated vs shared vs over-subscribed, etc.  

[LCMember1959]

Our Panorama server uses a volume on iSCSI storage (Dell Equallogic) with SAS disks. Everything else on the same storage solution works very fast, so I don't think that it's a bottleneck.

[Brandon_Wertz]

My company has a VM Pan with 2TB of storage as well and larger searches take minutes for me to run as well.  From my previous SE I was told this is a known issue and if you're having lots of logs or storage that a VM PAN solution is not the way to go.

We log anywhere from 80,000,000 to 160,000,000 logs to our panorama daily.  The management CPU is only ever around 10-20% but queries for greater than two weeks ago, especially for more than a day take 5+ minutes.

I think Palo's answer is going to be buy M100/500s and stack as needed.  We just deal with it.