©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
121
Manage
Log
Collection
Manage
Collector
Groups
Remove
a
Firewall
from
a
Collector
Group
In
a
distributed
log
collection
deployment,
where
you
have
dedicated
Log
Collectors,
if
you
need
a
device
to
send
logs
to
Panorama
instead
of
sending
logs
to
the
Collector
Group,
you
must
remove
the
device
from
the
Collector
group.
When
you
remove
the
device
from
the
Collector
Group
and
commit
the
change,
the
device
will
automatically
send
logs
to
Panorama
instead
of
sending
them
to
a
Log
Collector.
Step
3
Reconfigure
the
Log
Collector.
1.
2.
3.
.
4.
Step
4
.
Add
the
Log
Collector
to
its
new
Collector
Group
and
assign
firewalls
to
the
Log
Collector.
When
you
commit
the
Collector
Group
configuration,
Panorama
starts
redistributing
logs
across
the
Log
Collectors.
This
process
can
take
hours
for
each
terabyte
of
logs.
During
the
redistribution
process,
the
maximum
logging
rate
is
reduced.
Remove
a
Firewall
from
a
Collector
Group
1.
Select
the
Panorama > Collector Groups
tab.
2.
Click
the
link
for
the
desired
Collector
Group,
and
select
the
Log Forwarding
tab.
3.
In
the
Log
Forwarding
Preferences
section,
select
the
device
that
you
would
like
to
remove
from
the
list,
click
Delete
,
and
click
OK
.
4.
Click
Commit
,
for
the
Commit Type
select
Panorama
,
and
click
OK
.
5.
Click
Commit
,
for
the
Commit Type
select
Collector Group
,
and
click
OK
.
To
temporarily
remove
the
log
forwarding
preference
list
on
the
device,
you
can
delete
it
using
the
CLI
on
the
device.
You
must
however,
remove
the
assigned
firewalls
in
the
Collector
Group
configuration
on
Panorama.
Otherwise,
the
next
time
you
commit
changes
to
the
Collector
Group,
the
device
will
be
reconfigured
to
send
logs
to
the
assigned
Log
Collector.
Move
a
Log
Collector
to
Different
Collector
Group
(Continued)
