How to Configure Flexible Storage on SonicWall
08/04/2021 7 People found this article helpful 20,808 Views
The NSa firewalls can store Syslog and trace log entries to either the Built-In Storage or Flexible Storage modules. By default, these logs are sent to the Built-In Storage Module. This KB explains how the administrators can configure the Flexible Storage Module as the primary target for log storage.
The SonicWall NSa firewalls include Built-In Storage Modules. Capacities range from 16GB to 256GB.
|Product Model||Built-In Storage Module|
|NSa 2650||16 GB|
|NSa 3650||32 GB|
|NSa 4650||32 GB|
|NSa 5650||64 GB|
|NSa 6650||64 GB|
|NSa 9250||128 GB|
|NSa 9450||128 GB|
|NSa 9650||128 GB|
The NSa firewalls store Syslog and trace log entries to these modules. By default, these logs are sent to the Built-In Storage Module.
When the firewall is running, these logs are maintained in system memory. On a warm reset generated by software, the current database of up to 50,000 event log entries is written to a secondary storage module along with a set of the trace messages. Typically a trace log file is 1.28 MB times the number of CPUs in the firewall’s processor core. In the event of a cold reset (pressing the front panel switch), logs currently in memory are lost. Depending on capacity, the storage modules accumulate multiple snapshots of the logs in system memory at the time of warm-resets.
For Installation of Secondary Storage Modules Please follow the KB link: How to Install Secondary Storage Modules
When the firewall boots, it checks its serial number and the serial number of the Built-In Module and works with the License Manager and MySonicwall to ensure they are properly associated. If so, the Module will appear in the Monitor | Current Status > System Status with Association Status: Valid.
When the firewall boots, it reports the serial number of the Flexible Storage Module to the License Manager and MySonicwall to ensure it has not been found defective. Normally the Flexible Storage Module is activated and will appear under Monitor |Current Status | System Status with Association Status: Valid.
To define which storage module the logs, navigate to MANAGE | Logs and Reporting | Log Settings | Base Setup.
In the dialog box below, you can choose which secondary storage module to direct logs to and purge existing logs: either the current log presently in system memory, or the logs that are already in place on the storage module.