©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
181
Panorama
High
Availability
Logging
Considerations
in
Panorama
HA
Logging
Considerations
in
Panorama
HA
Setting
up
Panorama
in
an
HA
configuration
provides
redundancy
for
log
collection.
Because
the
managed
devices
are
connected
to
both
Panorama
peers
over
SSL,
when
a
state
change
occurs,
each
Panorama
sends
a
message
to
the
managed
devices.
The
devices
are
notified
of
the
Panorama
HA
state
and
can
forward
logs
accordingly.
The
logging
options
on
the
hardware
‐
based
Panorama
and
on
the
Panorama
virtual
appliance
differ:
Logging
Failover
on
a
Panorama
Virtual
Appliance
On
the
Panorama
virtual
appliance,
you
have
the
following
log
failover
options:
Logging
Failover
on
an
M
‐
100
Appliance
If
you
are
using
a
pair
of
M
‐
100
appliances
(must
be
in
Panorama
mode),
the
managed
devices
can
send
logs
to
only
one
peer
in
the
HA
pair,
either
the
active
or
the
passive
peer.
Unlike
the
virtual
Panorama
deployment,
you
cannot
configure
the
devices
to
send
logs
to
both
peers,
however,
the
RAID
‐
enabled
disks
on
the
M
‐
100
appliance
protect
against
disk
failure
and
loss
of
logs.
By
default,
when
the managed
devices
cannot
connect
to
Panorama
(M
‐
100
appliance
and
the
Panorama
virtual
appliance),
they
buffer
the
logs;
when
the
connection
is
restored,
they
resume
sending
logs
from
where
it
was last
left
off.
Log
Storage
Type
Description
Virtual
Disk
By
default,
the
managed
devices
send
logs
as
independent
streams
to
each
Panorama
HA
peer.
By
default,
if
a
peer
becomes
unavailable,
the
managed
devices
buffer
the
logs
and
when
the
peer
reconnects
it
resumes
sending
logs
from
where
it
had
left
off
(subject
to
disk
storage
capacity
and
duration
of
the
disconnection).
Logging
to
a
virtual
disk
provides
redundancy
in
logging.
However,
the
maximum
log
storage
capacity
is
2TB.
The
option
to
forward
logs
only
to
the
active
peer
is
configurable
(see
).
However,
Panorama
does
not
support
log
aggregation
across
the
HA
pair.
So,
if
you
log
to
a
virtual
disk
or
local
disk,
for
monitoring
and
reporting
you
must
query
the
Panorama
peer
that
collects
the
logs
from
the
managed
devices.
Network
File
Share
(NFS)
When
configured
to
use
an
NFS,
only
the
active
‐
primary
device
mounts
to
the
NFS
‐
based
log
partition
and
can
receive
logs.
On
failover,
the
primary
device
goes
into
a
passive
‐
primary
state.
In
this
scenario,
until
preemption
occurs,
the
active
‐
secondary
Panorama
manages
the
devices,
but
it
does
not
receive
the
logs
and
it
cannot
write
to
the
NFS.
To
allow
the
active
‐
secondary
peer
to
log
to
the
NFS,
you
must
manually
switch
it
to
primary
so
that
it
can
mount
to
the
NFS
partition.
For
instructions,
see
