Configure a Collector Group
Before configuring Collector Groups, decide whether each one will have a single Log Collector or multiple Log Collectors (up to 16). A Collector Group with multiple Log Collectors supports higher logging rates and log redundancy but has the following requirements:
- In any single Collector Group, all the Log Collectors must run on the same Panorama model: all M-500 appliances, all M-100 appliances, or all Panorama virtual appliances.
- (Best Practice) All Log Collectors in the same Collector Group should be in the same local area network (LAN). Avoid adding Log Collectors in the same or different wide area networks (WAN) to the same Collector Group as network disruption are much more common and may result in log data loss. Additionally, it is recommended that Log Collectors in the same Collector Group be in close physical proximity to each other to allow Panorama to quickly query the Log Collectors when needed.
- Add the Collector Group.
- Access the Panorama web interface, select, andPanoramaCollector GroupsAdda Collector Group or edit an existing one.
- Enter aNamefor the Collector Group if you are adding one.You cannot rename an existing Collector Group.
- Enter theMinimum Retention Periodin days (1 to 2,000) for which the Collector Group will retain firewall logs.By default, the field is blank, which means the Collector Group retains logs indefinitely.
- AddLog Collectors (1 to 16) to the Collector Group Members list.
- (Recommended)Enable log redundancy across collectorsif you are adding multiple Log Collectors to a single Collector group.Redundancy ensures that no logs are lost if any one Log Collector becomes unavailable. Each log will have two copies and each copy will reside on a different Log Collector. Enabling redundancy creates more logs and therefore requires more storage capacity. When a Collector Group runs out of space, it deletes older logs. Redundancy also doubles the log processing traffic in a Collector Group, which reduces its maximum logging rate by half, as each Log Collector must distribute a copy of each log it receives.
- Assign Log Collectors and firewalls to the Collector Group.
- SelectDevice Log ForwardingandAddlog forwarding preference listsfor the firewalls.A preference list determines the order in which Log Collectors will receive logs from a firewall. Perform the following steps for each set of firewalls that has the same preference list:
- In the Devices section,Modifythe list of firewalls and clickOK.
- In the Collectors section,AddLog Collectors to the preference list.If you assign multiple Log Collectors, the first one will be the primary; if the primary becomes unavailable, the firewalls send logs to the next Log Collector in the list. To change the priority of a Log Collector, select it andMove Up(higher priority) orMove Down(lower priority).
- Define the storage capacity (log quotas) and expiration period for each log type.
- Return to theGeneraltab and click theLog Storagevalue.
- Enter the log storageQuota(%)for each log type.
- Enter theMax Days(expiration period) for each log type (1 to 2,000).By default, the fields are blank, which means the logs never expire.
- Commit and verify your changes.
- Selectand thenCommitCommit and PushCommit and Pushyour changes to Panorama and the Collector Group you configured.
- Selectto verify the Log Collectors in the Collector Group are:PanoramaManaged Collectors
- Connected to Panorama—The Connected column displays a check mark icon to indicate that a Log Collector is connected to Panorama.
- Synchronized with Panorama—The Configuration Status column indicates whether a Log Collector isIn Sync(green icon) orOut of Sync(red icon) with Panorama.
- Next steps...
- The Collector Group won’t receive firewall logs until you configure the firewalls to forward to Panorama.
- You can configure each Collector Group to forward logs to separate destinations (such as a syslog server).
Recommended For You
Recommended videos not found.