Panoarama M-300 Log Storage

[d.Kim741433]

I am seeking clarification regarding the Log Storage Settings (Max) for the Panorama M-300 model.

According to the M-300 datasheet, the storage specification is:
"8 TB RAID Certified HDD (4) for 16 TB of RAID storage."

Based on this, my understanding is that with four 8 TB HDDs in a RAID configuration, the total usable capacity is 16 TB.

However, I have found some conflicting information regarding how this capacity is allocated:

Disk Allocation Logic: According to this KB article(https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5aCAC), ElasticSearch utilizes 66% of the disk, and within that, Detailed Logs are allocated 60% by default. This suggests that the actual usable space for Detailed Logs is approximately 39.6% of the total disk capacity.

For an 8 TB disk: ~3.168 TB usable.
For a 16 TB RAID setup: ~6.336 TB usable.

Discrepancy in Community Posts:
In this Live Community thread(https://live.paloaltonetworks.com/t5/panorama-discussions/panorama-firewall-logs/td-p/590838), a user with an M-300 HA (Active-Passive) setup shows a Max value of 26.05 TB in the Log Storage Settings.\

Given the 16 TB hardware limit stated in the datasheet, I am confused as to how the "Max" value can reach 26 TB or why it deviates so significantly from the 39% calculation.

Could someone please clarify the following?

What is the definitive Max Log Storage value that can be configured for the M-300 model?

Any insights or official documentation references would be greatly appreciated.

[ozheng]

Hello @d.Kim741433 ,

Both links are correct.
The first capacity is the total disk capacity : there are physically 4 slots for disks.
--> so physically you have 4* max size disk.

The 2nd link is about how the space above will then be used by the system.

So mathematically:
- 16TB disk space (RAID mirroring)

- then the 16TB will be formatted so you will probably get effectively something less.
--> that will give you the final disk space available for the logging.

The 66% / 33% is something you cannot change, and it is used for logging.

So technically it is already the logging space.

Olivier