A company is designing a log collection solution for 10 geographically dispersed Palo Alto Networks firewalls. Each firewall generates approximately 500 logs per second (LPS). The design requires a minimum of 1 year of log retention for compliance and historical analysis, with immediate access to logs for real-time monitoring and reporting. Which Panorama log collector deployment model should be chosen?
- APanorama Management Server as Log Collector
- BDedicated Log Collectors in Collector Group
- CExternal Syslog Server only
- DLocal firewall logging to disk
Show answer & explanationAnswer & explanation
Correct answer: B. Dedicated Log Collectors in Collector Group
For 10 firewalls generating 500 LPS each (total 5000 LPS) and requiring 1 year of retention, a dedicated Log Collector Group is necessary. The Panorama Management Server acting as a log collector has limited capacity (typically up to 1000 LPS and less retention), and local firewall logging or external syslog servers alone do not meet the centralized, long-term retention, and real-time reporting requirements of Panorama.
Why the other options are wrong
- A. The Panorama Management Server acting as a log collector is suitable for smaller environments (up to ~1000 LPS total) and typically has limited disk space for long-term retention, not meeting the specified requirements.
- C. An external Syslog server can store logs, but it lacks the integrated reporting, querying capabilities, and correlation features that Panorama offers for Palo Alto Networks firewalls.
- D. Local firewall logging is temporary and not centralized, failing to meet the long-term retention and centralized reporting requirements.
Panorama Log Collector Group
A deployment model for Panorama where multiple dedicated Log Collector appliances are grouped together to provide highly scalable and redundant log collection and storage for numerous managed firewalls, supporting high log rates and long-term retention.
- Scalable log collection (high LPS)
- Long-term log retention
- Centralized and redundant
- Supports multiple firewalls
Memory trick: Logs: Collect, store, and analyze for insight.