Enter a name to identify this Collector Group (up to 31 characters). The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, and underscores.

Indicates the total storage quota for firewall logs that the Collector Group receives and the available space.

Click the storage quota link to set the storage Quota(%) and expiration period (Max Days) for the following log types:

To use the default settings, click Restore Defaults.

Enter the minimum log retention period in days (1–2,000) that Panorama maintains across all Log Collectors in the Collector Group. If the current date minus the date of the oldest log is less than the defined minimum retention period, Panorama generates a System log as an alert violation.

Add the Log Collectors that will be part of this Collector Group (up to 16). You can add any of the Log Collectors that are available in the PanoramaManaged Collectors page. All the Log Collectors for any particular Collector Group must be the same model: for example, all M-500 appliances or all Panorama virtual appliances.

If you select this option, each log in the Collector Group will have two copies and each copy will reside on a different Log Collector. This redundancy ensures that, if any one Log Collector becomes unavailable, no logs are lost: you can see all the logs forwarded to the Collector Group and run reports for all the log data. Log redundancy is available only if the Collector Group has multiple Log Collectors and each Log Collector has the same number of disks. Log redundancy applies only to newly ingested logs after the setting is enabled and not to existing logs.

In the PanoramaCollector Groups page, the Log Redistribution State column indicates the completion status of the process as a percentage. All the Log Collectors for any particular Collector Group must be the same model: for example, all M-500 appliances or all Panorama virtual appliances.

Select to send logs to every Log Collector in the preference list. Panorama uses round-robin load balancing to select which Log Collector receives the logs at any given moment. This is disabled by default: firewalls send logs only to the first Log Collector in the list unless that Log Collector becomes unavailable (see Devices / Collectors).

Specify the location of the Collector Group.

The log forwarding preference list controls which firewalls forward logs to which Log Collectors. For each entry that you Add to the list, Modify the Devices list to assign one or more firewalls and Add one or more Log Collectors in the Collectors list.

By default, the firewalls you assign in a list entry will send logs only to the primary (first) Log Collector as long as it is available. If the primary Log Collector fails, the firewalls send logs to the secondary Log Collector. If the secondary fails, the firewalls send logs to the tertiary Log Collector, and so on. To change the order, select a Log Collector and click Move Up or Move Down.

For each type of firewall log that you want to forward from this Collector Group to external services, Add one or more match list profiles. The profiles specify which logs to forward and the destination servers. For each profile, complete the following:

Add one or more log ingestion profiles that allow Panorama to receive logs from the Traps ESM server. To configure a new log ingestion profile, see Panorama > Log Ingestion Profile.