A large enterprise with multiple geographically dispersed data centers needs to consolidate their log management and reporting for all Palo Alto Networks firewalls. Each data center has 50 firewalls, and there are 5 data centers in total. The security team requires at least 90 days of log retention for all log types (traffic, threat, URL, data, wildfire, system, config) and expects a daily average log rate of 10,000 logs/second across the entire deployment. Which Panorama log collector group design would be most appropriate and cost-effective?
- ADeploy one M-200 appliance at each data center to act as a local log collector.
- BDeploy a centralized log collector group with three M-600 appliances in an active/active configuration.
- CDeploy one M-600 appliance at each data center to act as a local log collector.
- DDeploy a centralized log collector group with two M-600 appliances in an active/passive HA configuration.
Show answer & explanationAnswer & explanation
Correct answer: D. Deploy a centralized log collector group with two M-600 appliances in an active/passive HA configuration.
Total daily log rate is 10,000 logs/second * 86400 seconds/day = 864,000,000 logs/day. For 90 days, this is 77,760,000,000 logs. An M-600 can handle up to 120,000 logs/second and has storage for approximately 100 billion logs for 90 days. A single M-600 could handle the volume, but for redundancy and high availability, two M-600s in active/passive HA provide the necessary resilience and capacity without over-provisioning.
Why the other options are wrong
- A. M-200 appliances have a much lower log ingestion rate (up to 10,000 logs/second) and less storage, making them insufficient for the total enterprise log volume.
- B. Three M-600s in active/active configuration would be over-provisioned for the given log rate and retention requirements, increasing cost unnecessarily. Active/passive is sufficient for redundancy in most log collector deployments.
- C. Deploying an M-600 at each data center (5 M-600s) is overkill for the total log volume and significantly more expensive than a centralized solution, as a single M-600 can handle the full load.
Panorama Log Collector Sizing
Sizing Panorama log collectors involves calculating total log ingestion rate and required storage capacity based on retention policies to select appropriate M-series appliances.
- M-200: up to 10,000 logs/sec, limited storage.
- M-600: up to 120,000 logs/sec, high storage capacity.
- Consider HA for redundancy.
- Centralized collection is often more efficient for large deployments.
Memory trick: Log collectors need to 'CAP'ture all 'DATA' and 'RETAIN' it.