The following figure illustrates Panorama in a centralized log collection deployment. In this example, the Panorama management server comprises two Panorama virtual appliances that are deployed in an active/passive high availability (HA) configuration. This configuration suits firewall management within a VMware virtual infrastructure in which Panorama processes up to 10,000 logs/second. (For details on deployment options, see Plan a Log Collection Deployment.) The firewalls send logs to the Panorama management server (to its virtual disk or Network File System [NFS] datastore). By default, the active and passive peers both receive logs, though you can Modify Log Forwarding and Buffering Defaults so that only the active peer does. By default, the Panorama virtual appliance uses approximately 11GB on its internal disk partition for log storage, though you can Expand Log Storage Capacity on the Panorama Virtual Appliance if necessary.
If the logging rate increases beyond 10,000 logs per second, it is recommended that you add Dedicated Log Collectors (M-Series appliances in Log Collector mode). Deploy Panorama with Dedicated Log Collectors describes a deployment with Dedicated Log Collectors managed by Panorama virtual appliances or by M-Series appliances in Panorama mode.
Figure: Panorama Virtual Appliances with Local Log Collection
Perform the following steps to deploy Panorama virtual appliances with local log collection. Skip any steps you have already performed (for example, the initial setup).
Deploy Panorama Virtual Appliances with Local Log Collection
Perform the initial setup of each Panorama virtual appliance. Install the Panorama Virtual Appliance. Perform Initial Configuration of the Panorama Virtual Appliance. Register Panorama and Install Licenses. Install Content and Software Updates for Panorama. Set Up HA on Panorama.
Perform the following steps to prepare Panorama for log collection. Add a Firewall as a Managed Device for each one that will forward logs to Panorama. Configure Log Forwarding to Panorama. ( Optional ) Configure Log Forwarding from Panorama to External Destinations.
Commit your changes. Click Commit, for the Commit Type select Panorama, and click Commit again.

Related Documentation