Upgrade Log Collectors When Panorama Is Internet-Connected
Upgrade Log Collector software to PAN-OS® 10.0 and install content updates using Panorama™ when Panorama is connected to the internet.
For a list of software or content updates you can install on Log Collectors, see Supported Updates.
You must upgrade all Log Collectors in a collector group at the same time to avoid losing log data loss. No log forwarding or log collection occurs if the Log Collectors in a collector group are not all running the same PAN-OS version. Additionally, the log data for the Log Collectors in the collector group is not visible in the
Monitortabs until all Log Collectors are running the same PAN-OS version. For example, if you have three Log Collectors in a collector group and you upgrade two of the Log Collectors, then no logs are forwarded to any Log Collectors in the collector group.
If you are upgrading from PAN-OS 8.1, PAN-OS® 9.0 introduced a new log data format for local and Dedicated Log Collectors. On your upgrade path to PAN-OS 10.0, existing log data is automatically migrated to the new format when you upgrade to PAN-OS 9.0. During reformatting, log data is not visible in the
Monitortabs. Additionally, new log data is not forwarded to Log Collectors until reformatting is complete. While the reformatting takes place, new logs are written to the firewall system disk and after the procedure is successfully completed, the new logs are forwarded to the appropriate Log Collector.
Palo Alto Networks recommends that you upgrade Log Collectors during a maintenance window. Due to log format migration, the entire upgrade procedure takes an additional number of hours depending on the amount of log data on the local and Dedicated Log Collectors.
- Before you upgrade Log Collectors, ensure that you are running the appropriate Panorama™ software release on the Panorama management server.Palo Alto Networks® highly recommends that Panorama and Log Collectors run the same Panorama software release and that Panorama, Log Collectors, and all managed firewalls run the same content release version. For important software and content compatibility details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.Panorama must be running the same (or later) software release as Log Collectors but must have the same or an earlier content release version:
To check software and content versions:
- Software release version—If your Panorama management server is not already running the same or a later software release than the release to which you intend to update Log Collectors, then you must install the same or a later Panorama release on Panorama (see Install Content and Software Updates for Panorama) before you update any Log Collectors.
- Content release version—For content release versions, you should ensure that all Log Collectors are running the latest content release version or, at minimum, running a later version than is running on Panorama; if not, then first update managed firewalls (using Panorama) and then update Log Collectors before you update the content release version on the Panorama management server.
- Panorama management server—To determine which software and content versions are running on the Panorama management server, log in to the Panorama web interface and go to General Information settings (Dashboard).
- Log Collectors—To determine which software and content versions are running on Log Collectors, log in to the CLI of each Log Collector and run theshow system infocommand.
- You cannot skip the installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 10.0. Review the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations in the New Features Guide for each release through which you pass as part of your upgrade path.If upgrading more than one Log Collector, streamline the process by determining the upgrade paths for all Log Collectors you intend to upgrade before you start downloading images.
- Install the latest content updates.
- SelectandPanoramaDevice DeploymentDynamic UpdatesCheck Nowfor the latest updates. If an update is available, the Action column displays aDownloadlink.
- If not already installed,Downloadthe appropriate content updates. After a successful download, the link in the Action column changes fromDownloadtoInstall.
- Installthe content update (Applications and Threats update) before any others.If your subscription includes both Applications and Threats content, install theAppscontent first. This automatically installs both Application and Threats content.Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
- Repeat the substeps above for any other updates (Antivirus, WildFire, or URL Filtering) as needed, one at a time, and in any sequence.
- Upgrade the Log Collector to the PAN-OS releases along your upgrade path to PAN-OS 10.0.If upgrading more than one Log Collector, streamline the process by determining the upgrade paths for all Log Collectors you intend to upgrade before you start downloading images.
- Upgrade Log Collectors When Panorama is Internet-Connected to PAN-OS 8.1.
- Upgrade Log Collectors When Panorama is Internet-Connected to PAN-OS 9.0.PAN-OS 9.0 introduced a new log format. Logs are automatically migrated to the new format after you successfully upgrade the Log Collector to PAN-OS 9.0.Do not continue on your upgrade path until you verify the automatic log migration completed successfully.
- Upgrade Log Collectors When Panorama is Internet-Connected to PAN-OS 9.1.
- Upgrade the Log Collector to PAN-OS 10.0.
- On Panorama,Check Now() for the latest updates. If an update is available, the Action column displays aPanoramaDevice DeploymentSoftwareDownloadlink.
- For each release in your upgrade path,Downloadthe model-specific file for the release version to which you are upgrading. For example, to upgrade an M-Series appliance to Panorama 10.0.0, download thePanorama_m-10.0.0image.After a successful download, the Action column changes fromDownloadtoInstallfor that image.
- InstallPAN-OS 10.0 and select the appropriate Log Collectors.
- Select one of the following depending on your needs:
- Upload only to device (do not install).
- Reboot device after install.
- ClickOKto start the upload or installation.
- Verify the software and content update versions that are installed on the Log Collector.Enter theshow system infooperational command. The output will resemble the following:sw-version: 10.0.0 app-version: 8270-6076 app-release-date: 2020/05/08 18:21:51
Recommended For You
Recommended videos not found.