10.2 Logging Architecture: Strata Logging Service, Log Forwarding, and Collectors

10.2 Logging Architecture: Strata Logging Service, Log Forwarding, and Collectors

Task 2.3 of the NGFW Engineer blueprint covers logging configuration, including the Strata Logging Service, log forwarding, and log collectors and log collector groups. Logging is how the firewall records every connection, threat, URL, and system event so that engineers can investigate incidents and demonstrate compliance.

---

Log Types Generated by PAN-OS

All logs are first written to the firewall's local log database, whose size is bounded by the platform's log quota settings.

---

Strata Logging Service (SLS)

Strata Logging Service (SLS) is Palo Alto Networks' cloud-delivered logging platform. It was previously known as Cortex Data Lake (and earlier as the Logging Service). SLS ingests firewall logs over the cloud, stores them at scale, and exposes them through the Strata Cloud Manager and Cortex applications for querying and reporting.

When to Use SLS

• Environments that want log storage without managing on-premises disk capacity.
• Cloud and hybrid NGFW fleets (including Cloud NGFW and Prisma Access) that already use cloud-delivered services.
• Organizations that need long retention and centralized queries across many firewalls.

SLS is licensed as part of the Strata Cloud Manager / Cortex bundle; the firewall authenticates and forwards logs to the regional SLS tenant.

---

Log Forwarding Profiles

A Log Forwarding Profile is the device-side object that decides what is forwarded and where. The blueprint item 2.3.2 (log forwarding) centers on this object.

How a Profile Works

1. The profile is created at the device level and references one or more destination servers (Strata Logging Service, syslog server, HTTP server, email, SNMP trap).
2. For each log type, the profile enables forwarding and can attach a match filter so only matching logs (for example, only severity high threats, or only traffic from a specific zone) are forwarded.
3. The profile is attached to a security policy rule, a decryption rule, or the device-wide log settings so that logs produced by that rule are forwarded.

Common Destinations

• Strata Logging Service: cloud storage and query.
• Syslog (UDP/TCP/TLS): traditional SIEM ingestion over standard syslog.
• HTTP/HTTPS server: custom endpoints or cloud SIEM APIs.
• Email and SNMP trap: alerting on specific high-severity events.

Filter-based forwarding is a key exam skill: rather than forwarding every traffic log to an expensive SIEM, engineers forward only threat logs or only high-severity events while sending the full stream to the cheaper Strata Logging Service.

---

Log Collectors and Log Collector Groups (Panorama)

When cloud logging is not permitted (regulated or air-gapped environments), Panorama provides on-premises log aggregation.

• Panorama Log Collector: a dedicated logging function, available on dedicated M-Series appliances (for example the M-600, M-700) or as the Panorama virtual log collector. It receives logs from connected firewalls and stores them on local disk.
• Log Collector Group: a group of log collectors that together serve a set of firewalls. Collector groups provide redundancy and capacity growth: adding collectors to a group increases aggregate storage and allows logs to survive a single collector failure.

Architecture Placement

Managed firewalls are assigned to a Log Collector Group (configured in Panorama under the device or device-group level). Each firewall forwards its logs to the assigned group, which stores them and makes them queryable through Panorama. This separates the management plane (Panorama config push) from the logging plane (collectors), so log volume does not consume Panorama's management performance.

---

On-Device Log Quotas and Retention

The firewall's local log database is finite. Log quotas set the maximum disk space each log type may consume; when a quota is reached, the oldest logs of that type are rotated out. Best practice is to reserve generous quotas for threat and WildFire logs (which drive investigations) and smaller quotas for routine traffic logs that are also forwarded off-device. Quota planning prevents a flood of low-value traffic logs from evicting high-value threat evidence.

---

Choosing Between SLS and On-Premises Collectors

Both options can coexist: a single firewall can forward some log streams to Strata Logging Service and others to an on-premises collector or SIEM simultaneously through different Log Forwarding Profile destinations.