How to Extend Panorama Logs to Dedicated Log Disk

How to Extend Panorama Logs to Dedicated Log Disk

20227
Created On 09/25/18 19:30 PM - Last Updated 05/28/20 01:18 AM


Environment
  • Panorama VM.
  • PAN-OS 8.0 and above.


Resolution

Details

By default, the Panorama Virtual Machine template provided by Palo Alto Networks firewall comes configured with a single disk, which hosts both the operating system and the logs collected from the associated firewalls. Shown below is an example of the VM configuration:

single-disk-config.PNG.png

 

The following screenshot is an example of system disk-partition and disk-space:

single-disk-output.PNG.png

 

The default disk provides 10 GB's of storage. If more storage is needed, a custom virtual disk can be attached to the VM and it will be used as a dedicated log disk.

Note: The maximum disk size is 2 TB's. With 8.0 the maximum size increases (24TB in the newer PAN-OS). For more info please see Panorama 8.10 admin guide.

Disk type needs to be SCSI, and the recommended VMWare disk provisioning is Thick Provision Lazy Zeroed, as shown in the example below:

01.initial-vm-config.PNG.png

 

After rebooting Panorama, the new partition and log disk size are visible by using the following CLI commands:

> show system disk-space
> show system disk-partition

02.disk-space.png

 

Important notes:

  • The total space allocated for log storage is the size of the attached virtual disk.
    For example, if attaching a 100GB disk the total log size will be 100 GB.
  • Attach only one log disk to Panorama VM. If other disks are attached, they will be ignored. With 8.1 the behavior is different. Please see Panorama 8.1 admin guide
  • Up until 8.0 disk size cannot be extended by modifying the disk size. If the disk size is modified, the allocated log database size remains the same as before. The actual disk size will be increased, but the partition size will not be increased by Panorama VM.

 

 



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClZfCAK&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language