Configure a Collector Group
Before configuring Collector Groups, decide whether each one will have a single Log Collector or multiple Log Collectors (up to 16). A Collector Group with multiple Log Collectors supports higher logging rates and log redundancy but has the following requirements:
- In any single Collector Group, all the Log Collectors must run on the same Panorama model: all M-600 appliances, all M-500 appliances, all M-200, all M-100 appliances, or all Panorama virtual appliances.
- Log redundancy is available only if each Log Collector has the same number of logging disks. To add disks to a Log Collector, see Increase Storage on the M-Series Appliance.
- (Best Practice) All Log Collectors in the same Collector Group should be in the same local area network (LAN). Avoid adding Log Collectors in the same or different wide area networks (WAN) to the same Collector Group as network disruption are much more common and may result in log data loss. Additionally, it is recommended that Log Collectors in the same Collector Group be in close physical proximity to each other to allow Panorama to quickly query the Log Collectors when needed.
- Perform the following tasks before configuring the Collector Group.
- Add the Collector Group.
- Access the Panorama web interface, select PanoramaCollector Groups, and Add a Collector Group or edit an existing one.
- Enter a Name for the Collector
Group if you are adding one.You cannot rename an existing Collector Group.
- Enter the Minimum Retention Period in
days (1 to 2,000) for which the Collector Group will retain firewall
logs.By default, the field is blank, which means the Collector Group retains logs indefinitely.
- Add Log Collectors (1 to 16) to the Collector Group Members list.
- (Recommended) Enable log redundancy
across collectors if you are adding multiple Log Collectors
to a single Collector group.Redundancy ensures that no logs are lost if any one Log Collector becomes unavailable. Each log will have two copies and each copy will reside on a different Log Collector. Enabling redundancy creates more logs and therefore requires more storage capacity. When a Collector Group runs out of space, it deletes older logs. Redundancy also doubles the log processing traffic in a Collector Group, which reduces its maximum logging rate by half, as each Log Collector must distribute a copy of each log it receives.
- Assign Log Collectors and firewalls to the Collector
- Select Device Log Forwarding and Addlog
forwarding preference lists for the firewalls.A preference list determines the order in which Log Collectors will receive logs from a firewall. Perform the following steps for each set of firewalls that has the same preference list:
- In the Devices section, Modify the list of firewalls and click OK.
- In the Collectors section, Add Log Collectors to the preference list.If you assign multiple Log Collectors, the first one will be the primary; if the primary becomes unavailable, the firewalls send logs to the next Log Collector in the list. To change the priority of a Log Collector, select it and Move Up (higher priority) or Move Down (lower priority).
- Click OK.
- Select Device Log Forwarding and Addlog forwarding preference lists for the firewalls.
- Define the storage capacity (log quotas) and expiration
period for each log type.
- Return to the General tab and click the Log Storage value.
- Enter the log storage Quota(%) for each log type.
- Enter the Max Days (expiration
period) for each log type (1 to 2,000).By default, the fields are blank, which means the logs never expire.
- Commit and verify your changes.
- Select CommitCommit and Push and then Commit and Push your changes to Panorama and the Collector Group you configured.
- Select PanoramaManaged Collectors to verify
the Log Collectors in the Collector Group are:
- Connected to Panorama—The Connected column displays a check mark icon to indicate that a Log Collector is connected to Panorama.
- Synchronized with Panorama—The Configuration Status column indicates whether a Log Collector is In Sync (green icon) or Out of Sync (red icon) with Panorama.
- Troubleshoot Connectivity to Network Resources to verify your firewalls successfully connected to the Log Collector.
- Next steps...
Log Forwarding to Panorama.The Collector Group won’t receive firewall logs until you configure the firewalls to forward to Panorama.
- (Optional) Configure
Log Forwarding from Panorama to External Destinations.You can configure each Collector Group to forward logs to separate destinations (such as a syslog server).
- Configure Log Forwarding to Panorama.
Move a Log Collector to a Different Collector Group
Move a Log Collector to a Different Collector Group M-600, M-500, M-200, M-100 and Panorama virtual appliances can have one or more Log Collectors in ...
Logging Failover on an M-Series Appliance or Panorama Virtual Appliance in Panorama Mode
Logging Failover on an M-Series Appliance or Panorama Virtual Appliance in Panorama Mode If you forward firewall logs to the local Log Collectors on an ...
Deploy Panorama Virtual Appliances with Local Log Collector...
Deploy Panorama Virtual Appliances with Local Log Collectors You can configure firewalls to send logs to a Log Collector that runs locally on a Panorama ...
Deploy Panorama M-Series Appliances with Local Log Collecto...
Deploy Panorama M-Series Appliances with Local Log Collectors The following figures illustrate Panorama in a centralized log collection deployment. In these examples, the Panorama management ...
Deploy Panorama with Dedicated Log Collectors
Deploy Panorama with Dedicated Log Collectors The following figures illustrate Panorama in a distributed log collection deployment. In these examples, the Panorama management server comprises ...
Managed Collectors and Collector Groups
Managed Collectors and Collector Groups Panorama uses Log Collectors to aggregate logs from managed firewalls. When generating reports, Panorama queries the Log Collectors for log ...
Caveats for a Collector Group with Multiple Log Collectors
Caveats for a Collector Group with Multiple Log Collectors You can Configure a Collector Group with multiple Log Collectors (up to 16) to ensure log ...
Collector Group Configuration
Collector Group Configuration To configure a Collector Group , click Add and complete the following fields. Collector Group Settings Configured In Description Name Panorama Collector ...
Manage Collector Groups
Manage Collector Groups A Collector Group is 1 to 16 Log Collectors that operate as a single logical unit for collecting firewall logs. You must ...