Log Retention for PA-1400

[nuranisnadiah]

Hi,

Specifically for PA-1420, I aware the storage capacity is 240GB. Is there anyway I can know the duration of log retention for 700 users?

From what I understand, log retention is affected by the space on disk, not on the number of user. When you run out of it, firewall will automatically deletes oldest entries in that specific log, whether it's traffic, threat, URL. 

Is my understanding correct?

[reaper]

log ingestion depends on many factors but the 'default' expectancy for a 1400 chassis is about 5tb for 30 days (so your 240gb will not get you far)

The logs are broken up into containers for each different log type (traffic, threat, ...) and log retention/pruning will be different for each container. once a container is full, logs will be pruned FIFO (oldest logs get deleted)

you are able to change the storage assigned to each container, so you are able to manipulate how much storage each type receives (e.g. if traffic log is less important than threat log, you could remove some storage % from traffic log container to reassign to the threat log container etc)

[OtakarKlier]

Hello,

It would be best to send the logs to a SIEM for longer term storage. There are many 'free' and low cost options available.

Regards,