The VM-Series firewall requires a virtual disk 40GB, of which 17GB is used for logging. For larger deployments, to aggregate data from all next-generation firewalls and provide visibility across all the traffic on your network, use Panorama for centralized logging and reporting. In smaller deployments, where you do not use Panorama but require more log storage capacity, use the following procedure to add a new virtual disk that can support 40GB to 2TB of storage capacity for logs.
When configured to use a virtual disk, the virtual appliance does not use the default 17GB storage for logging. Therefore, if it loses connectivity to the virtual disk, logs could be lost during the failure interval. To allow for redundancy, place the newly created virtual disk on a datastore that provides RAID redundancy. RAID10 provides the best write performance for applications with high logging characteristics.
Add a Virtual Disk to the VM-Series Firewall
Power off the VM-Series firewall.
On the ESX(i) server, add the virtual disk to the firewall. Select the VM-Series firewall on the ESX(i) server. Click Edit Settings. Click Add to launch the Add Hardware wizard, and select the following options when prompted: Select Hard Disk for the hardware type. Select Create a new virtual disk. Select SCSI as the virtual disk type. Select the Thick provisioning disk format. In the location field, select Store with the virtual machine option. The datastore does not have to reside on the ESX(i) server. Verify that the settings look correct and click Finish to exit the wizard. The new disk is added to the list of devices for the virtual appliance.
Power on the firewall. When powered on, the virtual disk is initialized for first-time use. The time that the initialization process takes to complete varies by the size of the new virtual disk. When the new virtual disk is initialized and ready, all logs from the existing disk will be moved over to the new virtual disk. Newly generated log entries will now be written to this new virtual disk. A system log entry that records the new disk is also generated.
If you reuse a virtual disk, that is if the disk was previously used for storing PAN-OS logs, all logs from the existing disk will not be moved over to the virtual disk.
Verify the size of the new virtual disk. Select Device > Setup > Management. In the Logging and Reporting Settings section, verify that the Log Storage capacity accurately displays the new disk capacity.

Related Documentation