How to enable Large Core files

• If there is not enough disk space in the root partition for a core file to be written, the core file will not be generated.
• Enabling the large-core feature will save large core files to the /opt/panlogs partition on the dataplane instead of the root partition in /var.

Warning:

• When enabling the large core feature, the space allocated for the large cores will be reserved in /opt/panlogs.
• If the /opt/panlogs partition is nearly full, this can cause some logs to be purged in order to make the space available.
• No warning regarding loss of logs will be given to users while enabling this feature.
• This may result in the loss of logs. So enable this feature after careful consideration.

• Palo Alto Firewalls or Panorama
• Supported PAN-OS

1. Use the below command to enable the large-core feature.

> configure
# set deviceconfig setting management large-core yes
# commit
# exit

2. To verify the amount of space reserved for large core, use the following command.

> debug software large-core show-reserved-space
Reserved log space for core: 2048MB
Large-core feature enabled

3. To disable large core files feature

> configure
# set deviceconfig setting management large-core no
# commit
# exit

4. To export the large core file, use the following command:  

>scp export core-file large-corefile from <core file name> to <scp server:/directory>

The large core files will be saved in /opt/panlogs/cores instead of /var/cores

5. After exporting a copy of the core file, delete the large core file using the following command:  

delete core-large file <core file name>