Panorama and collectors
I have a Panorama in Panorama mode on ESX. I have 2 collectors that collect logs from firewalls. The collectors are not set to forward logs to Panorama, that I know of, at least I don't see where this would be set, anyway.
When I look at Panorama, I see current traffic logs. Is Panorama pulling these live from the collectors? Or are the collectors just smart enough to forward logs to panorama even though there are no settings telling them to forward logs, and Panorama has them locally?
Also in Panorama, if I were to switch to management only mode, would that make it faster for management and committing, but then slower for reporting since it would have to pull the data from the collectors for reports?
It's hard to figure out how this really works from the documentation.
Panorama queries logs live from the collectors, so if you have 2 standalone collectors panorama will not have any (firewall) logs locally
You can add it as s 3rd collector or make it mgmt-only