All Palo Alto Networks firewalls can generate logs that
provide an audit trail of firewall activities. For Centralized Logging and Reporting, you must forward the logs generated on the firewalls to the Panorama™
management server or to Log Collectors that Panorama manages. Optionally,
you can then configure Panorama to forward the logs to external
logging destinations (such as syslog servers). If you forward logs
to a Panorama virtual appliance in Legacy mode, you don’t need to
perform any additional tasks to enable logging. If you forward logs
to Log Collectors, you must configure them as managed collectors
and assign them to Collector Groups. A managed collector can be
local to an M-500 appliance, M-100 appliance, or Panorama virtual
appliance in Panorama mode or can be an M-500 or M-100 appliance
in Log Collector mode (Dedicated Log Collector). To determine whether
to deploy either or both types of managed collectors, see Local and Distributed Log Collection.
To manage the System and Config logs that Panorama generates
locally, see Monitor Panorama.