Logs from secondary Panorama

[Goutham]

Hello Team,

We are having two panorama's configured in HA. As of now all the traffic is been handled by Primary Panorama and secondary is on handby. Now can we use the secondary panorama for log collection to decrease the CPU on primary?

if so kindly let us know how ? 

[PavelK]

Thank you for the post @Goutham

the scenario you mentioned is described in this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBw7CAG&lang=en_US%E2%80%A... Please refer to section: Collector Group Preference List

In nutshell, you will have to make sure that both log collectors (Primary and Secondary Panorama) are in the same log collector group, then you can configure log forwarding preference. Under log forwarding preference, you can for example split all your Firewalls into two lists. First half of the Firewalls will be ingesting logs by Primary Panorama (Secondary Panorama can be second in the list in the case Primary one is down). The second half of Firewalls will be ingesting logs by Secondary Panorama (Primary Panorama can be second in the list in the case Secondary one is down).

In this case, you decrease resource utilization on Primary Panorama by splitting load.

Here is a reference to documentation how to configure it: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-log-collection/manage-collecto...

Kind Regards

Pavel