©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
129
Manage
Log
Collection
Log
Collection
Deployments
Note
that
if
the
firewalls
have
a
remote
distribution,
their
connections
with
the
Panorama
management
server
might
lack
sufficient
bandwidth
to
support
the
required
logging
rate
even
if
the
server
can
process
logs
at
that
rate.
In
such
deployments,
forwarding
logs
to
dedicated
Log
Collectors
that
are
located
close
to
the
firewalls
might
resolve
the
bandwidth
limitation.
The
following
table
summarizes
your
choice
of
Log
Collector
when
considering
the
firewall
logging
rate.
Collector
Groups
with
Single
or
Multiple
Log
Collectors
Palo
Alto
Networks
recommends
assigning
only
one
Log
Collector
to
a
Collector
Group.
However,
if
any
single
firewall
will
generate
more
than
4TB
of
logs
(the
maximum
an
M
‐
100
appliance
can
store)
for
the
required
retention
period,
you
must
assign
multiple
Log
Collectors
to
the
Collector
Group
that
receives
the
logs.
To
understand
how
logging
works
in
the
latter
scenario,
as
well
as
the
risks
and
recommended
mitigations,
see
Log
Forwarding
Options
By
default,
each
firewall
generates
and
stores
log
files
locally.
To
use
Panorama
for
centralized
log
monitoring
and
report
generation,
you
must
forward
the
logs
to
Panorama.
If
you
have
compliance
policies
that
require
data
archival
for
extended
durations,
you
can
also
forward
logs
to
external
services
for
archiving,
notification,
or
analysis.
External
services
include
Syslog
servers,
servers,
or
SNMP
trap
servers.
The
device
(firewall,
Panorama
virtual
appliance,
or
M
‐
100
appliance)
that
forwards
the
logs
to
external
services
converts
the
logs
to
the
appropriate
format
(Syslog
message,
notification,
or
SNMP
trap).
You
must
create
a
server
profile
for
each
external
service.
A
server
profile
defines
how
to
access
the
remote
server
and
authenticate
to
the
service,
if
necessary.
You
can
configure
log
forwarding
in
the
following
ways:
Forward
logs
from
firewalls
to
Panorama
and
from
Panorama
to
external
services—This
configuration
suits
deployments
in
which
the
connections
between
firewalls
and
external
services
have
insufficient
bandwidth
to
sustain
the
logging
rate.
(This
is
often
the
case
when
the
connections
are
remote.)
This
configuration
improves
firewall
performance
by
offloading
some
processing
to
Panorama.
To
you
do
not
need
server
profiles.
To
configure
log
forwarding
from
Panorama
to
external
services,
define
server
profiles
using
the
Panorama > Server Profiles
options
(see
Logging
Rate
Log
Collector
≤
10,000
logs/second
Depends
on
the
Panorama
management
server:
•
Virtual
appliance—Panorama
collects
logs
without
any
Log
Collector.
•
M
‐
100
appliance—Local
default
Log
Collector
>
10,000
logs/second
M
‐
100
appliance
in
Log
Collector
Mode.
Each
dedicated
Log
Collector
can
process
up
to
50,000
logs/second
and
store
4
TB
of
log
data.
Add
dedicated
Log
Collectors
as
needed
when
the
logging
output
exceeds
these
thresholds.
To
forward
the
system
and
configuration
logs
that
Panorama
generates
locally
to
external
destinations,
see
.
