What is the deal with VM Panorama mode maximum log storage space?

Reply
Highlighted
L1 Bithead

What is the deal with VM Panorama mode maximum log storage space?

Hello,

Documentation states that VM Panorama mode can support up to 24TB of log storage on a single virtual appliance.

Each logging disk has 2TB of storage capacity for a total maximum of 24TB on a single virtual appliance

So we add 12 virtual disks with 2TB of storage to the machine.

 

> show system disk details shows 12 disks with 2097152 MB of storage. Good.
> show system disk-partition is where things get confusing. PAN-OS creates 1.7TB partitions for each disk no matter what:

 

Disk /dev/sdb: 2199.0 GB, 2199023255552 bytes, 4294967296 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: gpt


# Start End Size Type Name
1 19531 3706898437 1.7T Microsoft basic primary

Disk /dev/sdc: 2199.0 GB, 2199023255552 bytes, 4294967296 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: gpt

 

What exactly is going on here? Why only a range of 9531 - 3706898437 sectors being used? Which effectively limits disk size to roughly 1.7TB.

 

So now we are left with 20,4TB of total storage, in theory (12 x 1.7).

 

However, when we create a Collector Group and select all 12 disks - it only shows Max: 18.38 TB of storage!

 

Can someone please explain what happens to the rest, almost 6TB of storage?

 

Thank you.

Highlighted
L4 Transporter

Re: What is the deal with VM Panorama mode maximum log storage space?

@rmikalauskas I also had the same issue and here is a detailed article explaining the reason for the discrepancies: 

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5aCAC

Highlighted
L1 Bithead

Re: What is the deal with VM Panorama mode maximum log storage space?

I've read that article. It does not take into account that we are using virtual disks and not actual physical ones, where manufacturers count 1,000,000,000,000 bytes as a Terabyte. When we add 2TB disk in VMware - it is actually TB of size, or 2199023255552 bytes. As shown in PAN-OS itself.

 

Disk /dev/sdb: 2199.0 GB, 2199023255552 bytes, 4294967296 sectors

Units = sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk label type: gpt

 

#         Start          End    Size  Type            Name

1        20480   3706898431    1.7T  Microsoft basic primary

 

But for some reason it undersizes the partition and allocates only a range of 20480 - 3706898431 sectors, leaving us with 1897921510912 total bytes worth of storage. Which is actually 1.89 TB, not 1.7 TB. But I guess there is some overhead.

 

In any case - 588048385 sectors or ~300GB of storage goes "missing" after partitioning. That adds up to 3.6 TB of space if we add 12 drives. Significant, don't you think?

Highlighted
L4 Transporter

Re: What is the deal with VM Panorama mode maximum log storage space?

@rmikalauskas The point I was trying to make is that this is expected behaviour and not a fault. I agree it is misleading and is maybe you should raise it with you Palo Alto SE or Account manager.  

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!