Hi @PavelK ,
Thanks for help.
I have go through shared KB's but still have some queries regarding log redistribution when Collector group having three log collectors.
1. In current setup for location A firewalls (2 HA pair) - primary LC is location A panorama LC and secondary LC is location B panorama LC in log forwarding preference. Same for location B firewalls (2 HA pair) - primary LC is location B panorama LC and secondary LC is location A panorama LC in log forwarding preference. - What is the best option to add third LC in log forwarding preference list in order to utilize its space for logging. Do we add new LC as a tertiary in existing log forwarding preference lists or we should create new log forwarding preference list for some firewalls from the list and keep new LC as a primary and others as secondary , tertiary.
2. Currently we have configured Location A Panorama as primary and location B panorama as secondary in all locations firewall devices. Does this setting is effective only in case of firewall management when Panorama is in HA. Because as we are adding new LC in logger mode in existing LC group of Panorama where built in LC's also added , how firewalls will forward the log to this third LC if we keep this as a primary in log forwarding preference list for some firewall. As we are not mentioning third LC ip in panorama setting of firewalls.
3. In log forwarding preference , if primary LC is full does the log store to secondary LC. and if secondary LC is full does it store to tertiary LC.
4. Currently in both LC's in collector group is full and logs are purging after every five days. So after adding third LC in collector group after redistribution, disk quota of LC1 and LC2 will reduce ? will it lower down from 100 % utilization.
... View more
