Move a Log Collector to a Different Collector Group
M-600, M-500, M-200, M-100 and Panorama virtual appliances can have one or more Log Collectors in each Collector Group. You assign Log Collectors to a Collector Group based on the logging rate and log storage requirements of that Collector Group. If the rates and required storage increase in a Collector Group, the best practice is to Increase Storage on the M-Series Appliance or Configure a Collector Group with additional Log Collectors. However, in some deployments, it might be more economical to move Log Collectors between Collector Groups.
When a Log Collector is local to an M-500 or M-100 appliance in Panorama mode, move it only if the appliance is the passive peer in a high availability (HA) configuration. HA synchronization applies the configurations associated with the new Collector Group. Never move a Log Collector that is local to the active HA peer.
In any single Collector Group, all the Log Collectors must run on the same Panorama model: all M-600 appliances, all M-500 appliances, all M-200 appliances, all M-100 appliances, or all Panorama virtual appliances.
Log redundancy is available only if each Log Collector has the same number of logging disks. To add disks to a Log Collector, see Increase Storage on the M-Series Appliance.
- Remove the Log Collector from Panorama management.
- Select PanoramaCollector Groups and edit the Collector Group that contains the Log Collector you will move.
- In the Collector Group Members list, select and Delete the Log Collector.
- Select Device Log Forwarding and,
in the Log Forwarding Preferences list, perform the following steps
for each set of firewalls assigned to the Log Collector you will
- In the Devices column, click the link for the firewalls assigned to the Log Collector.
- In the Collectors column, select and Delete the Log Collector.To reassign the firewalls, Add the new Log Collector to which they will forward logs.
- Click OK twice to save your changes.
- Select PanoramaManaged Collectors and then select and Delete the Log Collector you will move.
a Collector Group.Add the Log Collector to its new Collector Group and assign firewalls to the Log Collector.When you push changes to the Collector Group configuration, Panorama starts redistributing logs across the Log Collectors. This process can take hours for each terabyte of logs. During the redistribution process, the maximum logging rate is reduced. In the PanoramaCollector Groups page, the Log Redistribution State column indicates the completion status of the process as a percentage.
- Configure Log Forwarding to Panorama for the new Collector Group you configured.
- Select CommitCommit and Push to commit your changes to Panorama and push the changes to device groups, templates, and Collector Groups if you have not already done so.
Configure a Collector Group
Configure a Collector Group Before configuring Collector Groups , decide whether each one will have a single Log Collector or multiple Log Collectors (up to ...
Logging Failover on an M-Series Appliance or Panorama Virtual Appliance in Panorama Mode
Logging Failover on an M-Series Appliance or Panorama Virtual Appliance in Panorama Mode If you forward firewall logs to the local Log Collectors on an ...
Deploy Panorama M-Series Appliances with Local Log Collecto...
Deploy Panorama M-Series Appliances with Local Log Collectors The following figures illustrate Panorama in a centralized log collection deployment. In these examples, the Panorama management ...
Deploy Panorama with Dedicated Log Collectors
Deploy Panorama with Dedicated Log Collectors The following figures illustrate Panorama in a distributed log collection deployment. In these examples, the Panorama management server comprises ...
Manage Collector Groups
Manage Collector Groups A Collector Group is 1 to 16 Log Collectors that operate as a single logical unit for collecting firewall logs. You must ...
Managed Collectors and Collector Groups
Managed Collectors and Collector Groups Panorama uses Log Collectors to aggregate logs from managed firewalls. When generating reports, Panorama queries the Log Collectors for log ...
Caveats for a Collector Group with Multiple Log Collectors
Caveats for a Collector Group with Multiple Log Collectors You can Configure a Collector Group with multiple Log Collectors (up to 16) to ensure log ...
Deploy Panorama Virtual Appliances with Local Log Collector...
Deploy Panorama Virtual Appliances with Local Log Collectors You can configure firewalls to send logs to a Log Collector that runs locally on a Panorama ...
Configure Storage Quotas and Expiration Periods for Logs and Reports
Configure Storage Quotas and Expiration Periods for Logs and Reports Configure the storage quotas and expiration periods for: Logs of all types that a Panorama ...