Log Collection Deployments
Deploy Panorama with Dedicated Log Collectors for high logging rates, or use local
collectors on M-Series or Virtual appliances. HA is recommended for automatic
recovery.
The following topics describe how to configure log collection in the most typical
deployments. Before starting,
plan your Panorama deployment according to
your current and future logging needs.
The deployments in these topics all describe Panorama in a high availability (HA)
configuration. Palo Alto Networks recommends HA because it enables automatic
recovery (in case of server failure) of components that are not saved as part of
configuration backups. In HA deployments, the Panorama management server only
supports an active/passive configuration.
To support high-volume environments where firewalls generate over 10,000 logs per second,
you should Deploy Panorama with Dedicated Log Collectors. This distributed architecture
offloads processing from the management server by sending logs to dedicated M-Series or
virtual appliances running in Log Collector mode, which are managed by the Panorama HA
pair.
For centralized logging requirements, you can Deploy Panorama M-Series Appliances with
Local Log Collectors. In this topology, firewalls forward logs directly to the
predefined local Log Collector residing on the active and passive Panorama M-Series
peers. If logging rates eventually exceed capacity, this deployment can be expanded by
adding Dedicated Log Collectors.
Similarly, for virtualized environments, you can Deploy Panorama Virtual Appliances with
Local Log Collectors. This configuration enables firewalls to send logs to a Log
Collector running locally on the Panorama virtual appliance. In an HA configuration, you
can assign the local Log Collectors on both peers to the same Collector Group or
separate groups depending on your redundancy requirements
