Document:Panorama™ Administrator’s Guide

Monitor Panorama

Search the Table of Contents

To monitor Panorama and its managed collectors, you can periodically view their System and Config logs ( filter the logs), configure a Simple Network Management Protocol (SNMP) manager to collect (GET) Panorama statistics on a regular basis, or configure SNMP traps or email alerts that notify you when a monitored metric changes state or reaches a threshold on Panorama. Email alerts and SNMP traps are useful for immediate notification about critical system events that need your attention. To configure email alerts or SNMP traps, see Configure Log Forwarding from Panorama to External Destinations.

Panorama System and Configuration Logs Monitor Panorama and Log Collector Statistics Using SNMP

Panorama System and Configuration Logs

You can configure Panorama to send notifications when a system event or configuration change occurs. By default, Panorama logs every configuration change to the Config logs. In the System logs, each event has a severity level to indicate its urgency and impact. When you Configure Log Forwarding from Panorama to External Destinations, you can forward all system events or just events of certain severity levels. The following table summarizes the severity levels:

Severity	Description
Critical	Indicates a failure and the need for immediate attention, such as a hardware failure, including high availability (HA) failover and link failures.
High	Serious issues that will impair the operation of the system, including disconnection of a Log Collector or a commit failure.
Medium	Mid-level notifications, such as Antivirus package upgrades, or a Collector Group commit.
Low	Minor severity notifications, such as user password changes.
Informational	Notification events such as log in or log out, any configuration change, authentication success and failure notifications, commit success, and all other events that the other severity levels don’t cover.

The M-Series appliance stores Config and System logs on its SSD. The Panorama virtual appliance stores the logs on the assigned storage volume (see Set Up the Panorama Virtual Appliance). If you need longer-term log storage for auditing, you can also Configure Log Forwarding from Panorama to External Destinations.

For information on using Panorama to monitor firewall logs, see Monitor Network Activity.

Monitor Panorama and Log Collector Statistics Using SNMP

You can configure an SNMP manager to request information from a Panorama management server and configure Panorama to respond. For example, the SNMP manager can request the high availability (HA) mode, Panorama state, and Panorama version. If the Panorama management server is an M-Series appliance in Panorama mode (not a virtual appliance), it can also provide logging statistics: average logs per second, storage duration of each log type, and log disk usage. Panorama doesn’t synchronize SNMP configurations between HA peers; you must enable SNMP requests and responses on each peer.

You can also configure a Dedicated Log Collector (M-Series appliance in Log Collector mode) to respond to requests for statistics such as connection status, disk drive metrics, software version, average CPU, average logs per second, and log storage duration for each log type. This information is useful when evaluating whether you need to expand log storage capacity.

You can’t configure an SNMP manager to control Panorama or Log Collectors (using SET messages); an SNMP manager can only collect statistics (using GET messages).

For details on how Panorama implements SNMP, see SNMP Support.

Monitor Panorama and Log Collector Statistics Using SNMP
Configure the SNMP Manager to get statistics from Panorama and the Log Collectors.	The following steps are an overview of the tasks you perform on the SNMP manager. For the specific steps, refer to the documentation of your SNMP manager. To enable the SNMP manager to interpret statistics, load the Supported MIBs and, if necessary, compile them. For each Panorama M-Series or virtual appliance that the SNMP manager will monitor, define its connection settings (IP address and port) and authentication settings (SNMPv2c community string or SNMPv3 username and password). All Panorama appliances use port 161. The SNMP manager can use the same or different connection and authentication settings for multiple Panorama management servers and Log Collectors. The settings must match those you define when you configure SNMP on Panorama (see Step 4 and Step 5). For example, if you use SNMPv2c, the community string you define when configuring Panorama must match the community string you define in the SNMP manager for Panorama. Determine the object identifiers (OIDs) of the statistics you will monitor. For example, to monitor the logging rate, a MIB browser shows that this statistic corresponds to OID 1.3.6.1.4.1.25461.2.3.30.1.1 in PAN-PRODUCT-MIB.my. For details, see Use an SNMP Manager to Explore MIBs and Objects. Configure the SNMP manager to monitor the desired OIDs.
Enable SNMP traffic on the management (MGT) interface of the Panorama management server.	Select Panorama > Setup > Management and edit the Management Interface Settings. In the Services section, select the SNMP check box and click OK.
Enable SNMP traffic on the management (MGT) interface of any M-Series appliances in Log Collector mode:	Select Panorama > Managed Collectors and select the Log Collector. Select the Management tab, select the SNMP check box, and click OK.
Configure the Panorama management server to respond to statistics requests from an SNMP manager.	Select Panorama > Setup > Operations and, in the Miscellaneous section, click SNMP Setup. Select the SNMP Version and configure the authentication values as follows. For version details, see SNMP Support. V2c —Enter the SNMP Community String, which identifies a community of SNMP managers and monitored devices (Panorama, in this case), and serves as a password to authenticate the community members to each other. Don’t use the default community string public ; it is well known and therefore not secure. V3 —Create at least one SNMP view group and one user. User accounts and views provide authentication, privacy, and access control when SNMP managers get statistics. Views—Each view is a paired OID and bitwise mask: the OID specifies a MIB, and the mask (in hexadecimal format) specifies which objects are accessible inside (include matching) or outside (exclude matching) that MIB. Click Add in the first list and enter a Name for the group of views. For each view in the group, click Add and configure the view Name, OID, matching Option ( include or exclude), and Mask. Users: Click Add in the second list, enter a username in the Users column, select the View group from the drop-down, enter the authentication password ( Auth Password) used to authenticate to the SNMP manager, and enter the privacy password ( Priv Password) used to encrypt SNMP messages to the SNMP manager. Click OK to save the settings.
Configure the Dedicated Log Collectors (if any) to respond to SNMP requests.	For each Collector Group: Select Panorama > Collector Groups and select the Collector Group. Select the Monitoring tab, configure the same settings as in Step 4, and click OK.
Commit your changes.	Click Commit, for the Commit Type select Panorama, and click Commit again. Click Commit, for the Commit Type select Collector Group, select the Collector Groups you edited, and click Commit again.
Monitor the Panorama and Log Collector statistics in an SNMP manager.	Refer to the documentation of your SNMP manager.

Document:Panorama™ Administrator’s Guide

Monitor Panorama

Table of Contents

Recommended For You

Recommended Videos