©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
119
Manage
Log
Collection
Manage
Collector
Groups
Step
4
Assign
Log
Collectors
and
firewalls
to
the
Collector
Group.
1.
Select
the
Device Log Forwarding
tab.
2.
In
the
Collector
Group
Members
section,
Add
the
Log
Collectors.
3.
In
the
Log
Forwarding
Preferences
section,
click
Add
.
4.
In
the
Devices
section,
click
Modify
,
select
the
firewalls,
and
click
OK
.
You
cannot
assign
PA
‐
7050
firewalls
to
a
Collector
Group.
However,
when
you
monitor
logs
or
generate
reports
for
a
device
group
that
includes
a
PA
‐
7050
firewall,
Panorama
queries
the
firewall
in
real
‐
time
to
display
its
log
data.
5.
In
the
Collectors
section,
Add
the
Log
Collectors
to
which
the
firewalls
will
forward
logs.
If
you
assign
multiple
Log
Collectors,
the
first
one
will
be
the
primary;
if
the
primary
becomes
unavailable,
the
firewalls
send
logs
to
the
next
Log
Collector
in
the
list.
To
change
the
priority
of
a
Log
Collector,
select
it
and
Move Up
(higher
priority)
or
Move Down
(lower
priority).
6.
Click
OK
.
Step
5
Define
the
storage
capacity
(log
quotas)
for
each
log
type.
1.
Return
to
the
General
tab
and
click
the
Log Storage
value.
If
the
field
displays
0MB,
verify
that
you
enabled
the
disk
pairs
for
logging
and
committed
the
changes
(see
,
Disks
tab).
2.
Enter
the
log
storage
Quota(%)
for
each
log
type.
Step
6
(
Optional
)
Configure
log
forwarding
from
the
Collector
Group
to
external
services.
To
perform
this
step,
you
must
have
added
server
profiles
for
the
external
services
in
the
task
1.
Select
the
Collector Log Forwarding
tab.
2.
For
each
log
Severity
level
in
the
System
,
Threat
,
and
Correlation
tabs,
click
a
cell
in
the
SNMP
Trap,
Profile,
or
Syslog
Profile
column,
and
select
the
server
profile.
3.
In
the
Config
,
HIP Match
,
and
Traffic
tabs,
select
the
SNMP
Trap
,
,
or
Syslog
server
profile.
4.
For
each
Verdict
in
the
WildFire
tab,
click
a
cell
in
the
SNMP
Trap,
Profile,
or
Syslog
Profile
column,
and
select
the
server
profile.
5.
Click
OK
to
save
the
Collector
Group.
Step
7
Commit
the
changes
and
verify
that
the
Log
Collectors
you
assigned
to
the
Collector
Group
are
connected
to,
and
synchronized
with,
Panorama.
1.
Click
OK
and
Commit
,
select
Panorama
as
the
Commit Type
,
then
click
OK
.
2.
Click
Commit
,
select
Collector Group
as
the
Commit Type
,
select
the
Collector
Group
you
added,
and
click
OK
.
3.
Select
Panorama > Managed Collectors
.
The
Connected
column
displays
a
check
mark
icon
to
indicate
that
a
Log
Collector
is
connected
to
Panorama.
The
Configuration
Status
column
indicates
whether
the
configurations
you
committed
to
Panorama
and
the
Log
Collectors
are
(green
icon)
or
are
not
(red
icon)
synchronized
with
each
other.
The
Collector
Group
won’t
receive
firewall
logs
until
you
Configure
a
Collector
Group
(Continued)
