Upgrade Log Collectors When Panorama Is Internet-Connected
Upgrade Log Collector software to PAN-OS® 9.0 and install content updates using Panorama™ when Panorama is connected to the internet.
For a list of software or content updates you can install on Log Collectors, see Supported Updates.
PAN-OS® 9.0 introduces a new log data format for local and Dedicated Log Collectors. When you upgrade to PAN-OS 9.0, existing log data is automatically migrated to the new PAN-OS 9.0 format. During reformatting, log data is not visible in the ACC or Monitor tabs. Additionally, new log data is not forwarded to Log Collectors until reformatting is complete. While the reformatting takes place, new logs are written to the firewall system disk and after the procedure is successfully completed, the new logs are forwarded to the appropriate Log Collector.
You must upgrade all Log Collectors in a collector group at the same time to avoid losing log data loss. No log forwarding or log collection occurs if the Log Collectors in a collector group are not all running the same PAN-OS version. Additionally, the log data for the Log Collectors in the collector group is not visible in the ACC or Monitor tabs until all Log Collectors are running the same PAN-OS version. For example, if you have three Log Collectors in a collector group and you upgrade two of the Log Collectors, then no logs are forwarded to any Log Collectors in the collector group.
Palo Alto Networks recommends that you upgrade Log Collectors during a maintenance window. Due to log format migration, the entire upgrade procedure takes an additional number of hours depending on the amount of log data on the local and Dedicated Log Collectors.
For M-100 appliances, Palo Alto Networks requires upgrading the memory to 32GB or more for management and log collection tasks. See the M-100 Memory Upgrade Guide before upgrading your M-100 appliance to PAN-OS 9.0.0.
- Before you upgrade Log Collectors, ensure that
you are running the appropriate Panorama™ software release on the
Panorama management server.Palo Alto Networks® highly recommends that Panorama and Log Collectors run the same Panorama software release and that Panorama, Log Collectors, and all managed firewalls run the same content release version. For important software and content compatibility details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.Panorama must be running the same (or later) software release as Log Collectors but must have the same or an earlier content release version:
To check software and content versions:
- Software release version—If your Panorama management server is not already running the same or a later software release than the release to which you intend to update Log Collectors, then you must install the same or a later Panorama release on Panorama (see Install Content and Software Updates for Panorama) before you update any Log Collectors.
- Content release version—For content release versions, you should ensure that all Log Collectors are running the latest content release version or, at minimum, running a later version than is running on Panorama; if not, then first update managed firewalls (using Panorama) and then update Log Collectors before you update the content release version on the Panorama management server.
- Panorama management server—To determine which software and content versions are running on the Panorama management server, log in to the Panorama web interface and go to General Information settings (Dashboard).
- Log Collectors—To determine which software and content versions are running on Log Collectors, log in to the CLI of each Log Collector and run the show system info command.
- Install the latest content updates.
- Check Now (PanoramaDevice DeploymentDynamic Updates) for the latest updates. If an update is available, the Action column displays a Download link.
- If not already installed, Download the appropriate content updates. After a successful download, the link in the Action column changes from Download to Install.
- Install the
content update (Applications or Applications and Threats update) before
any others:Click Install, select the Log Collectors, and click OK.Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
- Repeat substeps 2 and 3 above for any other updates (Antivirus, WildFire, or URL Filtering) as needed, one at a time, and in any sequence.
- Determine the Upgrade Path to
PAN-OS 9.0.You cannot skip the installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 9.0. Review the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations in the New Features Guide for each release through which you pass as part of your upgrade path.(Required if you are upgrading from a 7.1 or earlier release) PAN-OS 8.0 introduced a new log storage format. After upgrading to PAN-OS 8.0, you must Migrate Panorama Logs to the New Log Format before continuing in your upgrade path. Log migration is a one-time task; if you already migrated the logs on the Log Collector for an upgrade to PAN-OS 8.0, you do not need to migrate them again.If upgrading more than one Log Collector, streamline the process by determining the upgrade paths for all Log Collectors you intend to upgrade before you start downloading images.
- For all Log Collectors you intend to update to PAN-OS
9.0, continue using the upgrade path identified in Step 3 to upgrade
Log Collectors to your target Panorama release.
- On Panorama, Check Now (PanoramaDevice DeploymentSoftware) for the latest updates. If an update is available, the Action column displays a Download link.
- For each release in your upgrade path, Download the
model-specific file for the release version to which you are upgrading.
For example, to upgrade an M-Series appliance to Panorama 9.0.0,
download the Panorama_m-9.0.0 image.After a successful download, the Action column changes from Download to Install for that image.
- Click Install for the first (or next) version in your upgrade path and select the appropriate Log Collectors.
- Select one of the following depending on the version
you are installing within your upgrade path (Step 3):
- Upload only to device (do not install).
- Reboot device after install.
- Click OK to start the upload or installation.
- Repeat substeps 3 through 5 above until Log Collectors are running the desired release.
- Check the status of the log format migration after a
successful upgrade to PAN-OS 9.0.
- Log in to the Panorama CLI of the Log Collector.
- Run the following command to check the status of the
log format migration:
admin> debug logdb show-es-upgrade-timeExample response when the log format migration is still in progress:
Response from logger 23456212: 50.98% of indices upgraded complete. Approximately less than a minute remaining until migration is complete. Once the log migration is complete, please run the ‘show log-collector-es-cluster health’ command to check the ElasticSearch cluster status to verify logging and reporting functionality is restored.Response when the log format migration is completed:
Response from logger 23456212: 100% of indices complete, please run the ‘show log-collector-es-culster health’ command to check the ElasticSearch cluster status to verify logging and reporting functionality is restored.
- After the log format migration is complete, run the
following command to check the status of the ElasticSearch cluster
before you continue to the next step:
admin> show log-collector-es-cluster healthContinue to the next step when the “status” of the ElasticSearch cluster health displays “green”:
- Verify the software and content update versions that
are installed on the Log Collector.Enter the show system info operational command. The output will resemble the following:
sw-version: 9.0.0 app-version: 8085-5112 app-release-date: 2018/10/29 18:21:51
Upgrade Log Collectors When Panorama Is Not Internet-Connec...
Upgrade Log Collector software to PAN-OS® 8.1 and install content updates using Panorama™ when Panorama is not connected to the internet. ...
Install Updates for Panorama When Not Internet-Connected
Install Updates for Panorama When Not Internet-Connected If Panorama™ does not have a direct connection to the internet, perform the following steps to install Panorama ...
Install Updates for Panorama with an Internet Connection
Install Updates for Panorama with an Internet Connection If Panorama™ has a direct connection to the internet, perform the following steps to install Panorama software ...
Migrate Panorama Logs to the New Log Format
Migrate Panorama Logs to the New Log Format After you upgrade to a Panorama 8.0 or later release, Panorama Log Collectors use a new log ...
Install Updates for Panorama in an HA Configuration
Install Updates for Panorama in an HA Configuration To ensure a seamless failover when you update the Panorama software in a high availability (HA) configuration, ...
Upgrade Firewalls When Panorama Is Not Internet-Connected
Upgrade firewall software to PAN-OS® 8.1 and install content updates using Panorama™ when Panorama is not connected to the internet. ...
Software Updates for Dedicated Log Collectors
Software Updates for Dedicated Log Collectors Panorama > Managed Collectors To install a software image on a Dedicated Log Collector, download or upload the image ...
Install Content and Software Updates for Panorama
Install Content and Software Updates for Panorama A valid support subscription enables access to the Panorama software image and release notes. To take advantage of ...
Deploy Upgrades to Firewalls, Log Collectors, and WildFire Appliances Using Panorama
Use Panorama™ to test software and content updates on a subset of firewalls and Dedicated Log Collectors before you deploy to all your firewalls and ...