>
    Strata Copilot
    Managed Collectors and Collector Groups
    Focus
    Download PDF
    Focus
    1. Home
    2. Panorama
    3. Panorama Overview
    4. Centralized Logging and Reporting using Panorama
    5. Managed Collectors and Collector Groups
    Download PDF
    Panorama

    Managed Collectors and Collector Groups

    Table of Contents

    Managed Collectors and Collector Groups

    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Panorama)
    No prerequisites needed
    Panorama uses Log Collectors to aggregate logs from managed firewalls. When generating reports, Panorama queries the Log Collectors for log information, providing you visibility into all the network activity that your firewalls monitor. Because you use Panorama to configure and manage Log Collectors, they are also known as managed collectors. Panorama can manage two types of Log Collectors:
    • Local Log Collector
      This type of Log Collector runs locally on the Panorama management server. Only an M-700, M-600, M-500, M-300, or M-100 appliance, or Panorama virtual appliance in Panorama mode supports a local Log Collector.
    • Dedicated Log Collector
      This is an M-700, M-600, M-500, M-300, M-200, or M-100 appliance or Panorama virtual appliance in Log Collector mode. You can use an M-Series appliance in Panorama mode or a Panorama virtual appliance in Panorama or Legacy (ESXi and vCloud Air) mode to manage Dedicated Log Collectors. To use the Panorama web interface for managing Dedicated Log Collectors, you must add them as managed collectors. Otherwise, administrative access to a Dedicated Log Collector is only available through its CLI using the predefined administrative user (admin) account. Dedicated Log Collectors don’t support additional administrative user accounts. 
    You can use either or both types of Log Collectors to achieve the best logging solution for your environment (see Local and Distributed Log Collection).
    A Collector Group is 1 to 16 managed collectors that operate as a single logical log collection unit. If the Collector Group contains Dedicated Log Collectors, Panorama uniformly distributes the logs across all the disks in each Log Collector and across all Log Collectors in the group. This distribution optimizes the available storage space. To enable a Log Collector to receive logs, you must add it to a Collector Group. You can enable log redundancy by assigning multiple Log Collectors to a Collector Group (see Caveats for a Collector Group with Multiple Log Collectors). The Collector Group configuration specifies which managed firewalls can send logs to the Log Collectors in the group.
    To configure Log Collectors and Collector Groups, see Manage Log Collection.

    © 2026 Palo Alto Networks, Inc. All rights reserved.