128
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Log
Collection
Deployments
Manage
Log
Collection
Log
Collection
Deployments
The
following
topics
describe
how
to
configure
log
collection
in
the
most
typical
deployments.
Plan
a
Log
Collection
Deployment
To
determine
which
log
collection
deployment
best
suits
your
requirements,
review
the
following
topics:
High
Availability
As
a
best
practice,
Palo
Alto
Networks
recommends
deploying
the
Panorama
management
server
in
a
high
availability
(HA)
configuration
to
enable
automatic
recovery
(in
the
event
of
server
failure)
of
components
that
are
not
saved
as
part
of
configuration
backups.
For
details,
see
In
HA
deployments,
the
Panorama
management
server
only
supports
an
active/passive
configuration.
Panorama
and
Log
Collector
Platforms
Decide
which
to
use
for
the
Panorama
management
server
and
Log
Collectors
based
on
the
geographic
distribution
of
the
managed
firewalls
and
their
logging
rate.
The
deployments
in
these
topics
all
describe
Panorama
in
a
high
availability
(HA)
configuration,
which
Palo
Alto
Networks
recommends.
If
you
initially
implement
log
collection
using
the
default
Log
Collectors
but
later
require
more
storage
or
higher
logging
rates
than
these
support,
you
can
switch
to
a
deployment
with
dedicated
Log
Collectors
(M
‐
100
appliances
in
Log
Collector
mode).
You
can
also
implement
a
hybrid
deployment
that
includes
both
default
and
dedicated
Log
Collectors.
However,
if
you
initially
implement
log
collection
using
dedicated
Log
Collectors,
you
will
lose
logs
if
you
later
switch
to
a
deployment
that
involves
only
the
default
Log
Collectors
because
of
the
reduced
storage
capacity.
