Move a Log Collector to a Different Collector Group
M-600, M-500, M-200, M-100 and Panorama virtual
appliances can have one or more Log Collectors in each Collector
Group. You assign Log Collectors to a Collector Group based on the
logging rate and log storage requirements of that Collector Group.
If the rates and required storage increase in a Collector Group,
the best practice is to Increase
Storage on the M-Series Appliance or Configure
a Collector Group with additional Log Collectors. However,
in some deployments, it might be more economical to move Log Collectors
between Collector Groups.
When a Log
Collector is local to an M-500 or M-100 appliance in Panorama mode,
move it only if the appliance is the passive peer in a high availability
(HA) configuration. HA synchronization applies the configurations
associated with the new Collector Group. Never move a Log Collector
that is local to the active HA peer.
In any single Collector
Group, all the Log Collectors must run on the same Panorama model:
all M-600 appliances, all M-500 appliances, all M-200 appliances,
all M-100 appliances, or all Panorama virtual appliances.
Add the Log Collector to its new Collector Group and assign
firewalls to the Log Collector.
you push changes to the Collector Group configuration, Panorama
starts redistributing logs across the Log Collectors. This process
can take hours for each terabyte of logs. During the redistribution
process, the maximum logging rate is reduced. In the
the Log Redistribution State column indicates the completion status
of the process as a percentage.