18
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Centralized
Logging
and
Reporting
Panorama
Overview
Using
this
list,
FW1
will
forward
logs
to
L1,
its
primary
Log
Collector,
but
the
hash
algorithm
could
determine
that
the
logs
will
be
written
on
L2.
If
L2
becomes
inaccessible
or
has
a
chassis
failure,
FW1
will
not
know
about
its
failure
because
it
is
still
able
to
connect
to
L1,
its
primary
Log
Collector.
In
the
case
where
a
Collector
Group
has
only
one
Log
Collector
and
the
Log
Collector
fails,
the
firewall
stores
the
logs
to
its
HDD/SSD
(the
available
storage
space
varies
by
hardware
model),
and
resumes
forwarding
logs
to
the
Log
Collector
where
it
left
off
before
the
failure
occurred
as
soon
as
connectivity
is
restored.
With
multiple
Log
Collectors
in
a
Collector
Group,
the
firewall
does
not
buffer
logs
to
its
local
storage
when
it
can
connect
to
its
Primary
Log
Collector.
Therefore,
FW1
will
continue
sending
logs
to
L1.
Because
L2
is
unavailable,
the
Primary
Log
Collector
L1
buffers
the
logs
to
its
HDD,
which
has
10GB
of
log
space.
If
L2
remains
unavailable
and
the
logs
pending
for
L2
exceed
10GB,
L1
will
overwrite
the
older
log
entries
to
continue
logging.
In
such
an
event,
loss
of
logs
is
a
risk.
Therefore,
Palo
Alto
Networks
recommends
the
following
mitigations
if
using
multiple
Log
Collectors
in
a
Collector
Group:
Obtain
an
On
‐
Site
‐
Spare
(OSS)
to
enable
prompt
replacement
if
a
Log
Collector
failure
occurs.
In
addition
to
forwarding
logs
to
Panorama,
enable
forwarding
to
an
external
service
as
backup
storage.
The
external
service
can
be
a
Syslog
server,
server,
or
Simple
Network
Management
Protocol
(SNMP)
trap
server.
For
details,
see
.
Managed
Firewall
Log
Forwarding
Preference
List
Defined
on
a
Collector
Group
FW1
L1,L2,L3
FW2
L4,L5,L6
