Move a Log Collector to a Different Collector Group
M-500 and M-100 appliances can have one or
more Log Collectors in each Collector Group. You assign Log Collectors
to a Collector Group based on the logging rate and log storage requirements
of that Collector Group. If the rates and required storage increase
in a Collector Group, the best practice is to Increase Storage on the M-Series Appliance or Configure a Collector Group with
additional Log Collectors. However, in some deployments, it might
be more economical to move Log Collectors between Collector Groups.
When a Log Collector is local to an M-500
or M-100 appliance in Panorama mode, move it only if the appliance
is the passive peer in a high availability (HA) configuration. HA
synchronization applies the configurations associated with the new
Collector Group. Never move a Log Collector that is local to the
active HA peer.
In any single Collector Group, all the Log
Collectors must run on the same Panorama model: all M-500 appliances,
all M-100 appliances, or all Panorama virtual appliances.
Add the Log Collector to its new Collector Group and assign
firewalls to the Log Collector.
you push changes to the Collector Group configuration, Panorama
starts redistributing logs across the Log Collectors. This process
can take hours for each terabyte of logs. During the redistribution
process, the maximum logging rate is reduced. In the
the Log Redistribution State column indicates the completion status
of the process as a percentage.