GlobalProtect Logs Showing Only a Few Days of Retention on Panorama

[P.Aung950095]

Hello Community,

We are experiencing an issue with GlobalProtect log retention on Panorama.

Our Panorama manages 6 firewalls, and all firewalls are configured to forward logs to Panorama.

However, on Panorama, the GlobalProtect logs for the managed firewalls are only retained for about 6 days. When we check the output of the command show system logdb-quota, the Detailed Log Current Retention shows 16 days.

For Traffic logs, the Detailed Log Current Retention also shows 16 days, and Panorama retains approximately 16 days of Traffic logs as expected.

Based on the retention information reported by the command, we would expect the GlobalProtect logs to also be retained for around 16 days. However, they are only available for about 6 days.

Has anyone experienced a similar issue? Could you please advise how we should troubleshoot and resolve this issue?

Thank you.

[reaper]

the logdb quota is for the local system disk, it does not represent the log collector

you can see the allocated % in the log collector group "General" settings, via the configuration file or in CLI:

> set cli config-output-format set

> configure

# show | match 'general-setting management quota-settings disk-quota'

[P.Aung950095]

Hello @reaper 

Thank you for your assistance.

I confirmed that Panorama is using local log storage only and is acting as its own Log Collector. The suggested command did not return any output.

I also verified that the firewall itself still retains approximately one month of GlobalProtect logs locally. However, in Panorama (Monitor → GlobalProtect), I can only view approximately 6 days of logs.

In addition, the output of show system logdb-quota shows a retention estimate of 16 days for the detailed log database.

Given that the firewall retains the logs for much longer, do you have any suggestions on how to determine why Panorama is only displaying approximately 6 days of GlobalProtect logs? Could this indicate a log forwarding, indexing, or retention issue on Panorama?

Thank you for your assistance.

[reaper]

If the retention period on panorama is very short, this usually indicates a disk capacity issue and you may need to add more disk space

[P.Aung950095]

Hello @reaper and Community,

Thank you for your suggestion and recommendation solution.

I'm running Panorama 11.2.4-h10 in Panorama mode with a local Log Collector.

From show system logdb-quota, I can see:

Slot 0 Detailed retention: approximately 18 days

Detailed log usage: approximately 286 GB

I understand that GlobalProtect logs are stored in the Log Collector's Detailed database rather than the Panorama management database.

However, I observed unexpected behavior with GlobalProtect logs.

My expectation was that retention would operate as a rolling window. For example, if retention is 18 days, when Day 19 arrives, only Day 1 logs would be purged, while Days 2–19 would remain available.

Instead, what I observed was:

Historical GlobalProtect logs existed for approximately 18 days.

After reaching the retention period, the historical GlobalProtect logs disappeared.

I could only see the current day's GlobalProtect logs afterward.

What makes this more confusing is that Traffic and Threat logs were not affected. They still retained approximately 18 days of history and remained searchable on Panorama.

Therefore, this does not appear to be a general Log Collector storage or retention issue affecting all Detailed logs.

Has anyone experienced a situation where only GlobalProtect logs were purged while other Detailed log types remained available?

Are there any known issues in Panorama/PAN-OS 11.2.4-h10 related to:

GlobalProtect log retention

GlobalProtect log indexing

Log database rebuild/reindex

GlobalProtect log visibility in Panorama Monitor logs

Are there any CLI commands, database checks, or collector logs that would help determine why only GlobalProtect logs were affected while Traffic and Threat logs continued to retain their normal history?

Thank you for your assistance.