Will there be any log loss when re-generating metadata on Panorama?
7592
Created On 04/30/19 09:32 AM - Last Modified 04/30/19 19:08 PM
Question
When we are regenerating metadata on Panorama, will there be any loss of logs written to Panorama?
Command used -
> request metadata-regenerate slot <slot n>
Environment
- Panorama
- M-Series
Answer
- The disks on which the metadata is regenerated will be unavailable for write/read.
- If the Panorama/LC has multiple disks, it will continue to write logs to other disks if they are already up and running.
- However, if you are having a single disk(pair), and you have buffered log-forwarding disabled, then the logs at this time will not be forwarded to Panorama,
hence, lost. - In such scenarios, when you are regenerating metadata, make sure to enable buffered log-forwarding before starting the process,
if you want these logs can be retrieved later. - The default setting is, Buffered log Forwarding is enabled.
Buffered Log Forwarding:
https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/manage-log-collection/modify-log-forwarding-and-buffering-defaults.html
Additional Information
How to regenerate meta data:
https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/troubleshooting/troubleshoot-log-storage-and-connection-issues/regenerate-metadata-for-m-series-appliance-raid-pairs