GlobalProtect Logs Showing Only a Few Days of Retention on Panorama

[P.Aung950095]

Hello Community,

We are experiencing an issue with GlobalProtect log retention on Panorama.

Our Panorama manages 6 firewalls, and all firewalls are configured to forward logs to Panorama.

However, on Panorama, the GlobalProtect logs for the managed firewalls are only retained for about 6 days. When we check the output of the command show system logdb-quota, the Detailed Log Current Retention shows 16 days.

For Traffic logs, the Detailed Log Current Retention also shows 16 days, and Panorama retains approximately 16 days of Traffic logs as expected.

Based on the retention information reported by the command, we would expect the GlobalProtect logs to also be retained for around 16 days. However, they are only available for about 6 days.

Has anyone experienced a similar issue? Could you please advise how we should troubleshoot and resolve this issue?

Thank you.

[reaper]

the logdb quota is for the local system disk, it does not represent the log collector

you can see the allocated % in the log collector group "General" settings, via the configuration file or in CLI:

> set cli config-output-format set

> configure

# show | match 'general-setting management quota-settings disk-quota'

[P.Aung950095]

Hello @reaper 

Thank you for your assistance.

I confirmed that Panorama is using local log storage only and is acting as its own Log Collector. The suggested command did not return any output.

I also verified that the firewall itself still retains approximately one month of GlobalProtect logs locally. However, in Panorama (Monitor → GlobalProtect), I can only view approximately 6 days of logs.

In addition, the output of show system logdb-quota shows a retention estimate of 16 days for the detailed log database.

Given that the firewall retains the logs for much longer, do you have any suggestions on how to determine why Panorama is only displaying approximately 6 days of GlobalProtect logs? Could this indicate a log forwarding, indexing, or retention issue on Panorama?

Thank you for your assistance.