Logging Considerations in Panorama HA

Setting up Panorama in an HA configuration provides redundancy for log collection. Because the managed firewalls are connected to both Panorama peers over SSL, when a state change occurs, each Panorama sends a message to the managed firewalls. The firewalls are notified of the Panorama HA state and can forward logs accordingly.
By default, when the managed firewalls cannot connect to Panorama, they buffer the logs; when the connection is restored, they resume sending logs from where it was last left off.
The logging options on the hardware-based Panorama and on the Panorama virtual appliance differ:

Related Documentation