Reason Why Logs Are Received by SLS but Not Stored

[ym-higashi]

In Strata Logging Service, ACTUAL RETENTION DAYS was shown as 0 for certain log types (such as firewall_traffic).

Meanwhile, we observed that system and dns_security logs have increasing ACTUAL RETENTION DAYS.
I understanding is that when ACTUAL RETENTION DAYS is 0, it indicates that SLS is not retaining logs for that log type.
We have confirmed that CONFIGURED RETENTION DAYS is set to 366 days.
Additionally, the Dashboard → Incoming Logs Rate confirms that the firewall is successfully sending logs to SLS.
Why is SLS receiving these logs but not storing them?

[BPry]

@ym-higashi,

Do you actually have enough licenses to cover all of the devices and have you setup the association properly? 

[Brandon_Wertz]

---

@ym-higashi wrote:

In Strata Logging Service, ACTUAL RETENTION DAYS was shown as 0 for certain log types (such as firewall_traffic).

Meanwhile, we observed that system and dns_security logs have increasing ACTUAL RETENTION DAYS.
I understanding is that when ACTUAL RETENTION DAYS is 0, it indicates that SLS is not retaining logs for that log type.
We have confirmed that CONFIGURED RETENTION DAYS is set to 366 days.
Additionally, the Dashboard → Incoming Logs Rate confirms that the firewall is successfully sending logs to SLS.
Why is SLS receiving these logs but not storing them?

---

I suspect there's something else going on.  A while back maybe 2-4 months Palo Alto changed how they billed for SLS storage.  Now customers just get a year, you shouldn't be paying for "X" amount of TBs anymore.  This might be something you should bring up with your Palo account team.

As an example...there's no way we're paying for 1800 days for storage, but Palo has adjusted the product: