©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
17
Panorama
Overview
Centralized
Logging
and
Reporting
Managed
Collectors
and
Collector
Groups
A
Log
Collector
can
be
local
to
an
M
‐
100
appliance
in
Panorama
mode
(default
Log
Collector)
or
can
be
an
M
‐
100
appliance
in
Log
Collector
mode
(dedicated
Log
Collector).
Because
you
use
Panorama
to
configure
and
manage
Log
Collectors,
they
are
also
known
as
Managed
Collectors.
An
M
‐
100
appliance
in
Panorama
mode
or
a
Panorama
virtual
appliance
can
manage
dedicated
Log
Collectors.
To
administer
dedicated
Log
Collectors
using
the
Panorama
web
interface,
you
must
add
them
as
Managed
Collectors.
Otherwise,
administrative
access
to
a
dedicated
Log
Collector
is
only
available
through
its
CLI
using
the
default
administrative
user
(
admin
)
account.
Dedicated
Log
Collectors
do
not
support
additional
administrative
user
accounts.
A
Collector
Group
is
1
to
16
managed
collectors
that
operate
as
a
single
logical
log
collection
unit.
If
the
group
contains
dedicated
Log
Collectors,
the
logs
are
uniformly
distributed
across
all
the
disks
in
each
Log
Collector
and
across
all
members
in
the
Collector
Group.
This
distribution
maximizes
the
use
of
the
available
storage
space.
To
manage
a
Log
Collector,
you
must
add
it
to
a
Collector
Group.
Palo
Alto
Networks
recommends
placing
only
one
Log
Collector
in
a
Collector
Group
unless
more
than
4TB
of
storage
space
is
required
in
a
Collector
Group.
For
details,
see
The
Collector
Group
configuration
specifies
which
managed
firewalls
can
send
logs
to
the
Log
Collectors
in
the
group.
After
you
configure
the
Log
Collectors
and
enable
the
firewalls
to
forward
logs,
each
firewall
forwards
its
logs
to
the
assigned
Log
Collector.
Managed
Collectors
and
Collector
Groups
are
integral
to
a
distributed
log
collection
deployment
on
Panorama.
A
distributed
log
collection
deployment
allows
for
easy
scalability
and
incremental
addition
of
dedicated
Log
Collectors
as
your
logging
needs
grow.
The
M
‐
100
appliance
in
Panorama
mode
can
log
to
its
default
Collector
Group
and
then
be
expanded
to
a
distributed
log
collection
deployment
with
one
or
more
Collector
Groups
that
include
dedicated
Log
Collectors.
Caveats
for
a
Collector
Group
with
Multiple
Log
Collectors
Although
Palo
Alto
Networks
recommends
placing
only
one
Log
Collector
in
a
Collector
Group,
if
you
have
a
scenario
where
you
need
more
than
4TB
of
log
storage
capacity
in
a
Collector
Group
for
the
required
log
retention
period,
you
can
add
up
to
16
Log
Collectors
to
the
group.
For
example,
if
a
single
managed
firewall
generates
12
TB
of
logs,
you
will
require
at
least
three
Log
Collectors
in
the
Collector
Group
that
receives
those
logs.
If
a
Collector
Group
contains
multiple
Log
Collectors,
the
available
storage
space
is
used
as
one
logical
unit
and
the
logs
are
uniformly
distributed
across
all
the
Log
Collectors
in
the
Collector
Group.
The
log
distribution
is
based
on
the
disk
capacity
of
the
Log
Collectors
(which
ranges
from
1TB
to
4TB,
depending
on
the
number
of
disk
pairs)
and
a
hash
algorithm
that
dynamically
decides
which
Log
Collector
owns
the
logs
and
writes
to
disk.
Although
Panorama
uses
a
preference
list
to
prioritize
the
list
of
Log
Collectors
to
which
a
managed
firewall
can
forward
logs,
Panorama
does
not
necessarily
write
the
logs
to
the
first
Log
Collector
specified
in
the
preference
list.
For
example,
consider
the
following
preference
list:
If
you
use
Panorama
to
manage
firewalls
running
both
PAN
‐
OS
5.0
and
a
PAN
‐
OS
version
earlier
than
5.0,
note
the
following
compatibility
requirements:
•
Only
devices
running
PAN
‐
OS
v5.0
can
send
logs
to
a
dedicated
Log
Collector.
•
Devices
running
PAN
‐
OS
versions
earlier
than
5.0
can
only
send
logs
to
a
Panorama
virtual
appliance
or
to
an
M
‐
100
appliance
in
Panorama
mode.
