120
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Manage
Collector
Groups
Manage
Log
Collection
Move
a
Log
Collector
to
a
Different
Collector
Group
When
you
you
assign
Log
Collectors
to
a
Collector
Group
based
on
the
logging
rate
and
log
storage
requirements
of
that
Collector
Group.
If
the
rates
and
required
storage
increase
in
a
Collector
Group,
the
best
practice
is
to
or
with
additional
Log
Collectors.
However,
in
some
deployments,
it
might
be
more
economical
to
move
Log
Collectors
between
Collector
Groups.
The
log
data
on
a
Log
Collector
becomes
inaccessible
after
you
remove
it
from
a
Collector
Group.
Also,
you
must
perform
a
factory
reset
on
the
Log
Collector
before
adding
it
to
another
Collector
Group;
a
factory
reset
removes
all
configuration
settings
and
logs.
When
a
Log
Collector
is
local
to
an
M
‐
100
appliance
in
Panorama
mode,
move
it
only
if
the
M
‐
100
appliance
is
the
passive
peer
in
a
high
availability
(HA)
configuration.
HA
synchronization
will
restore
the
configurations
that
the
factory
reset
removes.
Never
move
a
Log
Collector
when
it’s
local
to
an
M
‐
100
appliance
that
is
the
active
HA
peer.
Move
a
Log
Collector
to
Different
Collector
Group
Step
1
Remove
the
Log
Collector
from
Panorama
management.
1.
Select
Panorama > Collector Groups
and
select
the
Collector
Group
that
contains
the
Log
Collector
you
will
move.
2.
Select
the
Device Log Forwarding
tab
and,
in
the
Log
Forwarding
Preferences
list,
perform
the
following
steps
for
each
set
of
firewalls
assigned
to
the
Log
Collector
you
will
move:
a.
In
the
Devices
column,
click
the
link
for
the
firewalls
assigned
to
the
Log
Collector.
b.
In
the
Collectors
column,
select
the
Log
Collector
and
click
Delete
.
To
reassign
the
firewalls,
Add
the
new
Log
Collector
to
which
they
will
forward
logs.
c.
Click
OK
twice
to
save
your
changes.
3.
Select
Panorama > Managed Collectors
,
select
the
Log
Collector
you
will
move,
and
click
Delete
.
4.
Click
Commit
,
for
the
Commit Type
select
Panorama
,
and
click
OK
.
5.
Click
Commit
,
for
the
Commit Type
select
Collector Group
,
select
the
Collector
Group
from
which
you
deleted
the
Log
Collector,
and
click
OK
.
Step
2
Reset
the
Log
Collector
to
its
factory
default
settings.
1.
Log
in
to
the
CLI
of
the
Log
Collector.
2.
Enter
the
following
CLI
command:
debug
system
maintenance
‐
mode
The
Log
Collector
will
reboot
in
maintenance
mode.
3.
After
the
Log
Collector
reboots,
press
Enter
to
access
the
maintenance
mode
menu.
4.
Select
Factory Reset
and
press
Enter.
5.
Select
Factory Reset
and
press
Enter
again.
The
Log
Collector
will
reboot,
after
which
it
won’t
have
any
configuration
settings
or
log
data.
The
default
username
and
password
to
log
in
to
the
Log
Collector
is
admin/admin.
