Logging rate in Panorama device health monitoring is significantly higher than incoming log rate as viewed on firewall. Netflow is enabled.

• When viewing the Logging Rate for a firewall from Panorama under Panorama > Managed Devices > Health, the observed value is significantly higher than the log incoming rate as observed on the firewall under `debug log-receiver statistics` or the received log forwarding rate on external log forwarding destinations.
• The log written rate in `debug log-receiver statistics` is also higher than the log incoming rate.

Panorama:

Firewall:

• Panorama managed firewall
• Netflow enabled

When netflow is enabled on the firewall, any session traversing the netflow enabled interfaces will generate additional traffic logs at session start and session end, as well as at intervals during the session. These logs are then converted to netflow records to be sent to the netflow collector. They are not otherwise saved or forwarded.

Because these additional netflow records follow the same logging pipeline as normal traffic logs, some logging statistics may include them. This includes the log written rate in `debug log-receiver statistics`, which is the metric that is forwarded to Panorama for device health monitoring. 

This is expected behavior.

While netflow related logs are not recorded or forwarded like normal traffic logs, their generation does count towards platform logging capacity.

When comparing log generation rates to log forwarding rates, or received log rates on log forwarding destinations, use the log incoming rate or specific log type counters as observed in `debug log-receiver statistics` on the firewall.