Palo Alto Networks Knowledgebase: How to Extend Panorama Logs to Dedicated Log Disk

How to Extend Panorama Logs to Dedicated Log Disk

7480
Created On 02/08/19 00:00 AM - Last Updated 02/08/19 00:00 AM
Cortex Data Lake Panorama
Resolution

Details

By default, the Panorama Virtual Machine template provided by Palo Alto Networks firewall comes configured with a single disk, which hosts both the operating system and the logs collected from the associated firewalls. Shown below is an example of the VM configuration:

single-disk-config.PNG.png

 

The following screenshot is an example of system disk-partition and disk-space:

single-disk-output.PNG.png

 

The default disk provides 10 GB's of storage. If more storage is needed, a custom virtual disk can be attached to the VM and it will be used as dedicated log disk.

Note: The maximum disk size is 2 TB's. With 8.0 the maximum size increases.
For more info please see Panorama 8.0 admin guide 

 

Disk type needs to be SCSI, and the recommended VMWare disk provisioning is Thick Provision Lazy Zeroed, as shown in the example below:

01.initial-vm-config.PNG.png

 

After rebooting Panorama, the new partition and log disk size is visible by using the following CLI commands:

> show system disk-space
> show system disk-partition

02.disk-space.png

 

Important notes:

  • The total space allocated for log storage is the size of the attached virtual disk.
    For example, if attaching a 100GB disk the total log size will be 100 GB.
  • Attach only one log disk to Panorama VM. If other disks are attached, they will be ignored. With 8.0 the behavior is different. Please see Panorama 8.0 admin guide
  • Up until 8.0 disk size cannot be extended by modifying the disk size. If the disk size is modified, the allocated log database size remains the same as before. The actual disk size will be increased, but the partition size will not be increased by Panorama VM.

 

owner: bbolovan



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClZfCAK&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language