Focus

Panorama Administrator's Guide

Modify Log Forwarding and Buffering Defaults

Table of Contents

Modify Log Forwarding and Buffering Defaults

You can define the log forwarding mode that the firewalls use to send logs to Panorama and, when configured in a high availability (HA) configuration, specify which Panorama peer can receive logs. To access these options, select PanoramaSetupManagement, edit the Logging and Reporting Settings, and select Log Export and Reporting.

Define the log forwarding mode on the firewall: The firewalls can forward logs to Panorama (pertains to both the M-Series appliance and the Panorama virtual appliance) in either Buffered Log Forwarding mode or in the Live Mode Log Forwarding mode.

Logging Options	Description
(`Best Practice`) Buffered Log Forwarding from Device Default: Enabled	Allows each managed firewall to buffer logs and send the logs at 30-second intervals to Panorama (not user configurable). Buffered log forwarding is very valuable when the firewall loses connectivity to Panorama. The firewall buffers log entries to its local hard disk and keeps a pointer to record the last log entry that was sent to Panorama. When connectivity is restored the firewall resumes forwarding logs from where it left off. The disk space available for buffering depends on the log storage quota for the firewall model and the volume of logs that are pending roll over. If the firewall was disconnected for a long time and the last log forwarded was rolled over, all the logs from its local hard disk will be forwarded to Panorama on reconnection. If the available space on the local hard disk of the firewall is consumed, the oldest entries are deleted to allow logging of new events.
Live Mode Log Forwarding from Device This option is enabled when the check box for Buffered Log Forwarding from Device is cleared.	In live mode, the managed firewall sends every log transaction to Panorama at the same time as it records it on the firewall.

Logging Options

Description

(Best Practice) Buffered Log Forwarding from Device

Default: Enabled

Allows each managed firewall to buffer logs and send the logs at 30-second intervals to Panorama (not user configurable).

Buffered log forwarding is very valuable when the firewall loses connectivity to Panorama. The firewall buffers log entries to its local hard disk and keeps a pointer to record the last log entry that was sent to Panorama. When connectivity is restored the firewall resumes forwarding logs from where it left off.

The disk space available for buffering depends on the log storage quota for the firewall model and the volume of logs that are pending roll over. If the firewall was disconnected for a long time and the last log forwarded was rolled over, all the logs from its local hard disk will be forwarded to Panorama on reconnection. If the available space on the local hard disk of the firewall is consumed, the oldest entries are deleted to allow logging of new events.

Live Mode Log Forwarding from Device

This option is enabled when the check box for Buffered Log Forwarding from Device is cleared.

In live mode, the managed firewall sends every log transaction to Panorama at the same time as it records it on the firewall.

Verify Log Forwarding to Panorama

Configure Log Forwarding from Panorama to External Destinations