Configure Storm Control

1. In the Ethernet or aggregate Ethernet interface dialog, select the Storm Control tab.
2. For each traffic type, enter the rising threshold as a percentage of port speed (0-100%).
3. For Action, choose what PAN-OS does when the rising threshold is exceeded:

   • (Default) Drop: Silently discards traffic above the threshold. This is the default action and is always performed to prevent traffic storms from escalating and causing network failures.
   • Error: Discards traffic and places the interface in Error-Disable state. To recover the port, set the link state to Down and commit, then set the link state to Up and commit again.
   • Log: Generates a log entry approximately every minute when drops occur, without disabling the port.

4. Select OK.

When the Log or Error action is configured, PAN-OS writes a system log entry to the storm-control subtype each time a storm condition is detected on a port. PAN-OS evaluates the hardware Ingress Rate Limit Drop Counter at the end of each 1-minute monitoring window. If drops occurred during that window, one log entry is generated per affected interface. At most one log entry per minute per interface is produced, regardless of the number of packets dropped.

You can retrieve the storm control log from both web interface (MonitorLogsSystem) and the CLI.

To retrieve storm control log entries from the CLI, run:

show log system subtype equal storm-control

The following table describes the fields in a storm control system log entry:

Field	Value	Description
Time	YYYY/MM/DD HH:MM:SS	Timestamp at which the log entry was generated.
Severity	critical	Fixed severity level assigned to all storm control log entries.
Subtype	storm-control	Log subtype used to identify and filter storm control entries.
Object	port	Indicates the affected object type is a physical port.
EventID	if-storm-detect	Identifies the event as an interface-level storm detection.
ID	0	Internal event identifier.
Description	Free-form text	Contains the aggregate number of BUM packets received during the monitoring window and the name of the affected interface. This is a cumulative count for the 1-minute window, not an instantaneous rate.

The following example shows a storm control log entry:

Time                Severity Subtype                   Object EventID                   ID Description
=======================================================================================================
2026/07/08 01:59:15 critical storm-control             port   if-storm-detect           0  storm control applied on port ethernet1/12(traffic:Unknown-Unicast, bytes:8568)