Preserve Existing Logs When Adding Storage on Panorama Virtual Appliance in Legacy Mode

The Panorama virtual appliance in Legacy mode can use only one virtual disk for logging. Therefore, if you add a virtual disk that is dedicated for logging, Panorama stops using the default 11GB log storage on the system disk and copies any existing logs to the new logging disk. (Panorama continues using the system disk for data other than logs.)
If you replace an existing dedicated logging disk of up to 2TB storage capacity with a disk of up to 8TB, you will lose the logs on the existing disk. To preserve the logs, your choices are:
  • Configure log forwarding to external destinations before you replace the virtual disk.
  • Set up a new Panorama virtual appliance for the new 8TB disk and maintain access to the Panorama containing the old disk for as long as you need the logs. To forward firewall logs to the new Panorama virtual appliance, one option is to reconfigure the firewalls to connect with the new Panorama IP address (select DeviceSetupManagement and edit the Panorama Settings), add the firewalls as managed devices to the new Panorama, and Configure Log Forwarding to Panorama. To reuse the old Panorama IP address on the new Panorama, another option is to export the configuration of the old Panorama and then import and load the configuration on the new Panorama.
  • Copy logs from the old disk to the new disk. Copying can take several hours, depending on how many logs the disk currently stores, and Panorama cannot collect logs during the process. Contact Palo Alto Networks Customer Support for instructions.

Related Documentation