: Logging Failover on an M-Series Appliance or Panorama Virtual Appliance in Panorama Mode
Focus
Focus

Logging Failover on an M-Series Appliance or Panorama Virtual Appliance in Panorama Mode

Table of Contents

Logging Failover on an M-Series Appliance or Panorama Virtual Appliance in Panorama Mode

If you forward firewall logs to the local Log Collectors on an HA pair of M-600 appliances, M-500 appliances, M-200 appliances, M-100 appliances, or Panorama virtual appliances in Panorama mode, you specify which firewalls send logs to which Log Collectors when you Configure a Collector Group. You can configure a separate Collector Group for the Log Collector of each Panorama peer or configure a single Collector Group to contain the Log Collectors of both peers. In a Collector Group that contains both local Log Collectors, the log forwarding preference list determines which Log Collector receives logs from firewalls. For the PA-7000 Series and PA-5200 Series firewalls, you have the option to send logs to all the Log Collectors in the Collector Group, in which case Panorama uses round-robin load balancing to select which Log Collector receives the logs at any given moment.
In a Collector Group that contains both Log Collectors, you can also enable redundancy so that each log will have two copies and each copy will reside on a different Log Collector. This redundancy ensures that, if any one Log Collector becomes unavailable, no logs are lost: you can see all the logs forwarded to the Collector Group and run reports for all the log information. Log redundancy is available only if each Log Collector in the Collector Group has the same number of disks.
All the Log Collectors for any particular Collector Group must be the same model: all M-100 appliances, all M-200 appliances all M-500 appliances, all M-600 appliances or all Panorama virtual appliances in Panorama mode.
Because enabling redundancy creates more logs, this configuration requires more storage capacity. Enabling redundancy doubles the log processing traffic in a Collector Group, which reduces its maximum logging rate by half, as each Log Collector must distribute a copy of each log it receives. (When a Collector Group runs out of space, it deletes older logs.)

Recommended For You