>
    Strata Copilot
    Monitor Panorama
    Focus
    Download PDF
    Focus
    1. Home
    2. Panorama
    3. Monitor Panorama
    Download PDF
    Panorama

    Monitor Panorama

    Table of Contents

    Monitor Panorama

    Ensure operational health by reviewing System and Configuration logs. Configure SNMP to collect statistics and trigger alerts for critical events.
    To ensure the operational health of your management infrastructure, you can monitor Panorama and its managed collectors by periodically reviewing system logs and utilizing automated SNMP monitoring. These methods allow you to track administrative activity, assess system status, and receive immediate alerts for critical events.
    Panorama System and Configuration Logs: Administrators can periodically view System and Configuration logs to track activity on the appliance. These logs provide a historical record of the operational status of the system. To efficiently locate specific events or activities relevant to your monitoring needs, you can filter these logs by type (such as system, config, or userID logs.
    Monitor Panorama and Log Collector Statistics Using SNMP: For automated monitoring, you can configure an SNMP manager to actively collect (GET) Panorama statistics on a regular basis. Additionally, you can configure SNMP traps or email alerts to automatically notify you when a monitored metric changes state or reaches a specific threshold on Panorama. These alerts are useful for immediate notification about critical system events that require attention. To enable these alerts, you must configure the system to forward logs to your monitoring server. To configure email alerts or SNMP traps, see Configure Log Forwarding from Panorama to External Destinations.

    Panorama System and Configuration Logs

    You can configure Panorama to send notifications when a system event or configuration change occurs. By default, Panorama records every configuration change in the Config logs. In the System logs, each event has a severity level to indicate its urgency and impact. When you Configure Log Forwarding from Panorama to External Destinations, you can forward all System and Config logs or filter the logs based on attributes such as the receive time or severity level (System logs only). The following table summarizes the severity levels for System logs.
    Panorama regularly connects to the IoT Edge Service to download policy recommendations for IoT based policies. This connection is attempted by Panorama regardless of whether the IoT license is active on any managed firewalls..
    A high severity gRPC connection failure system log is generated in the event of connection failure or if Panorama manages no IoT licensed firewall. No action is needed regarding these system logs if you are not leveraging the policy recommendation capabilities of IoT or if you are not managing any IoT licensed firewalls.
    If you are leveraging the policy recommendation capabilities of IoT, review the gRPC connection failure system log to understand what is causing the connection issue between Panorama and the IoT Edge Service.
    Panorama does not support querying configuration logs in the ACC or when monitoring configuration logs (MonitorLogs) using the filters:
    before-change-preview-contains
    after-change-preview-contains
    Severity
    Description
    Critical
    Indicates a failure and the need for immediate attention, such as a hardware failure, including high availability (HA) failover and link failures.
    High
    Serious issues that will impair the operation of the system, including disconnection of a Log Collector or a commit failure.
    Medium
    Mid-level notifications, such as Antivirus package upgrades, or a Collector Group configuration push.
    Low
    Minor severity notifications, such as user password changes.
    Informational
    Notification events such as log in or log out, any configuration change, authentication success and failure notifications, commit success, and all other events that the other severity levels don’t cover.
    Panorama stores the System and Config logs locally; the exact location and storage capacity varies by Panorama model (see Log and Report Storage). Upon reaching the capacity limit, Panorama deletes the oldest logs to create space for new logs. If you need to store the logs for longer periods than what the local storage allows, you can Configure Log Forwarding from Panorama to External Destinations.
    For information on using Panorama to monitor firewall logs, see Monitor Network Activity.

    © 2026 Palo Alto Networks, Inc. All rights reserved.