What is the deal with VM Panorama mode maximum log storage space?

[RMikalauskas]

Hello,

Documentation states that VM Panorama mode can support up to 24TB of log storage on a single virtual appliance.

Each logging disk has 2TB of storage capacity for a total maximum of 24TB on a single virtual appliance

So we add 12 virtual disks with 2TB of storage to the machine.

> show system disk details shows 12 disks with 2097152 MB of storage. Good.
> show system disk-partition is where things get confusing. PAN-OS creates 1.7TB partitions for each disk no matter what:

Disk /dev/sdb: 2199.0 GB, 2199023255552 bytes, 4294967296 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: gpt

# Start End Size Type Name
1 19531 3706898437 1.7T Microsoft basic primary

Disk /dev/sdc: 2199.0 GB, 2199023255552 bytes, 4294967296 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: gpt

What exactly is going on here? Why only a range of 9531 - 3706898437 sectors being used? Which effectively limits disk size to roughly 1.7TB.

So now we are left with 20,4TB of total storage, in theory (12 x 1.7).

However, when we create a Collector Group and select all 12 disks - it only shows Max: 18.38 TB of storage!

Can someone please explain what happens to the rest, almost 6TB of storage?

Thank you.

[BatD]

@RMikalauskas I also had the same issue and here is a detailed article explaining the reason for the discrepancies: 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5aCAC

[RMikalauskas]

I've read that article. It does not take into account that we are using virtual disks and not actual physical ones, where manufacturers count 1,000,000,000,000 bytes as a Terabyte. When we add 2TB disk in VMware - it is actually TB of size, or 2199023255552 bytes. As shown in PAN-OS itself.

Disk /dev/sdb: 2199.0 GB, 2199023255552 bytes, 4294967296 sectors

Units = sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk label type: gpt

#         Start          End    Size  Type            Name

1        20480   3706898431    1.7T  Microsoft basic primary

But for some reason it undersizes the partition and allocates only a range of 20480 - 3706898431 sectors, leaving us with 1897921510912 total bytes worth of storage. Which is actually 1.89 TB, not 1.7 TB. But I guess there is some overhead.

In any case - 588048385 sectors or ~300GB of storage goes "missing" after partitioning. That adds up to 3.6 TB of space if we add 12 drives. Significant, don't you think?

[BatD]

@RMikalauskas The point I was trying to make is that this is expected behaviour and not a fault. I agree it is misleading and is maybe you should raise it with you Palo Alto SE or Account manager.  

[sbendzus]

@RMikalauskas 

did you ever get an answer?
I have had a case open at Palo TAC for several days now and I have the feeling that nobody there knows (any more) why this is the case.

"1.7T is the max for 1 partition.
Whatever you are observing is expected behavior.
The system will not allocate more than 1.7T to a partition, even if the disk is bigger.

Let's consider if you have a disk of 4TB size the system will create two partitions of 1.7T and 1.7T size but if you have a disk of 2 TB size it will only create one partition of 1.7T size.

The system creates that partition with exactly the same size of 1.7T to fit in any disk of any vendor of 2TB. It is hardcoded in PanOS and cannot be changed"


I tried on my lab panorama.

Added a 1TB disk.

admin@Panorama> show system disk details
Name : sdb
State : Present
Size : 1048576 MB
Status : Available
Reason : Admin enabled

#show system disk-partition

.
.
# Start End Size Type Name
1 20480 2048020479 976.6G Microsoft basic primary


from the partition table it should have 976.6G
from show system disk-space = 962G

admin@Panorama> show system disk-space

Filesystem Size Used Avail Use% Mounted on
/dev/root 7.9G 4.6G 2.9G 63% /
none 7.9G 100K 7.9G 1% /dev
/dev/sda5 24G 1.4G 22G 6% /opt/pancfg
/dev/sda6 5.9G 1.4G 4.2G 25% /opt/panrepo
tmpfs 7.9G 284M 7.6G 4% /dev/shm
cgroup_root 7.9G 0 7.9G 0% /cgroup
/dev/sda8 32G 1.3G 29G 5% /opt/panlogs
/dev/loop0 9.8G 23M 9.2G 1% /opt/logbuffer
/dev/sdb1 962G 77M 913G 1% /opt/panlogs/ld1

🤷‍♂️

[RMikalauskas]

Nope. I just stopped worrying about it and accepted it as "by design".