On your firewalls and Panorama appliances, allow access to the ports and FQDNs required to connect to. The Active-Secondary will send back an acknowledgement that it is ready. What is the estimated configuration size? have an average size of 1500 bytes when stored in the logging service. There are three primary reasons for configuring log collectors in a group: When considering the use of log collector groups there are a couple of considerations that need to be addressed at the design stage: The information that you will need includes desired retention period and average log rate. Throughput means through show system statics session. This number accounts for both the logs themselves as well as the associated indices. To use, download the file named ". It provides secure connectivity to all spoke VCNs, Oracle Cloud Infrastructure services, public endpoints and clients, and on-premises data center networks. The Active-Primary will then send the configuration to the Active-Secondary. The maximum recommended value is 1000 ms. You should be able to trial one I would think. While most current Panorama platforms have an upper limit of 1000 devices for management purposes (5000 firewalls using M-600 appliances or similarly resourced Panorama virtual appliances since PAN-OS 9.0), it is important for Panorama sizing to understand what the incoming log rate will be from all managed devices. These aspects are Device Management and Logging. A general design guideline is to keep all collectors that are members of the same group close together. These presets cover a majority of customer deployments. The additional dataplane interfaces are used to connect to multiple networks such as Internet facing, untrust, DMZ, trust, web front end, application layer and database. The performance will depend on Azure VM size and Sometimes, it is not practical to directly measure or estimate what the log rate will be. The design considerations are covered below.Note:As of PANOS 8.1, not only can anyplatform can be configured asa dedicated manager, but also a dedicated log collector. This subreddit is for those that administer, support or want to learn more about Palo Alto Networks firewalls. Hub - Palo Alto Networks Cortex Data Lake Estimator Use this tool to estimate the amount of Cortex Data Lake storage you may need to purchase. The table below outlines the maximum number of logs per second that each hardware platform can forward to Panorama and can be used when designing a solution to calculate the maximum number of logs that can be forwarded to Panorama in the customer environment. Ensure that all of these requirements are addressed with the customer when designing a log storage solution. Choose the filters below to compare our next-generation firewalls, including physical appliances and virtualized firewalls. The world's first ML-Powered Next-Generation Firewall enables you to prevent unknown . up to 185 : up to 290 . Fortinet Products Comparison. 3. A PA-220 for example, is rated for 560Mbps, but at home I can run well over 1Gbps through it with every feature turned on (SSL decrypt only on some traffic). system-mode: legacy. In addition to collecting logs from deployed firewalls, reports can be generated based on that log data whether it resides locally to the Panorama (e.g single M-series or VM appliance) for on a distributed logging infrastructure. IPS 5 Gbps. This website uses cookies essential to its operation, for analytics, and for personalized content. The member who gave the solution and all future visitors to this topic will appreciate it! If so, then the throughput with those features enabled is going to be reduced. Significantly improve detection accuracy with trillions of multi-source artifacts. In these cases suggest Syslog forwarding for archival purposes. Dedicated Panoramas running in log collector mode to collect and manage logs from managed devices. You will find useful tips for planning and helpful links for examples. FORTINET NAMED A LEADER IN THE 2022 GARTNER MAGIC QUADRANT FOR NETWORK FIREWALLS. Palo Alto Networks Traps endpoint protection and response and Cortex XDR: Palo Alto Networks Traps Advanced Endpoint Protection running version 5.0+ with Traps management service. Log Ingestion Requirements: This is the total number of logs that will be sent per second to the Panorama infrastructure. There are different driving factors for this including both policy based and regulatory compliance motivators. Test everything you can imagine like tunnels, failover, maybe some IPv6 (this is where the real fun starts). This is in stark contrast to their closest competitor. After you have real data, you can resize the VM sizelower or higher as needed using the Azure Portal. This could be for a few reasons; you haven't adopted many SaaS applications, aren't yet building complex applications in the cloud, or simply don't operate in a highly regulated industry. The Panorama solution is comprised of two overall functions: Device Management and Log Collection/Reporting. Log Collection for GlobalProtect Cloud Service Remote Office. This article contains a brief overview of the Panorama solution, which is comprised of two overall functions: Device Management and Log Collection/Reporting. This section will cover the information needed to properly size and deploy Panorama logging infrastructure to support customer requirements. It definitely gets tough when the client can't give more than general info like this. I have a PA-500, PA-820, PA-3050 (x2, they are HA pair) and a PA-3020. Threat Protection Throughput. As /u/datadilemma and /u/Robe_ mentioned, you need a better understanding of the type of traffic you'll be handling and the features you'll be using on that traffic. Press question mark to learn the rest of the keyboard shortcuts, https://www.paloaltonetworks.com/resources/datasheets/product-summary-specsheet, https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clc8CAC. Threat prevention throughput3, 4. Next-Generation Firewall Cortex XDR Agents Prisma Access (Remote Networks) Prisma Access (Mobile Users) Cortex XDR IoT Security Next-Generation Firewall Average Log Rate In early March, the Customer Support Portal is introducing an improved Get Help journey. communication on PAN-OS 10.0 and later versions: Use proxy to send logs to Cortex Data Please use the form below for sizing recommendation from an expert on any Palo Alto Networks product. The Residential Electrical Load Calculator is Pre-Loaded with electrical information for you to chose from. external Network ---- 250 Mbps IN /OUT ------ FW PA5060 ------400 Mbps IN . The minimum requirements for a Panorama virtual appliance running 8.1, 9.0 and 9.1is 16vCPUs and 32GB vRAM. Effortlessly run advanced AI and machine learning with cloud-scale data and compute. Set Up the Panorama Virtual Appliance with Local Log Collector. For additional log storage you can attach an additional data disk VHD. In this case, 'Log Delay' is the undesired result of high latency - logs don't show up in the UI until well after they are sent to Panorama. There are two aspects to high availability when deploying the Panorama solution. The local log partition for current firewall models are: The second method is to place multiple log collectors into a group. Most likely you are in legacy mode,.. Panorama has some steep CPU requirements. There are two methods to buffer logs. All rights reserved. Use the following spreadsheet to take an inventory of your devices that need to store logs: Read the following article on how to determine the lograte for yourself:How to Determine Log Rate on VM Panorama or M-100 with a Log-Collector. We use these to front end some web facing applications that get thousands of hits per second, and that initial processing that takes place on the PA to first . Whether you're a VLAN veteran looking to tackle a complex deployment or a network novice trying to . Rule 8-200 of the 2012 CE Code covers load calculations used to determine the minimum feeder or service size for single dwelling units. up to 370 : Physical Enclosure 1UDesktop . IPS and SSL checks are heavy on CPU and sometimes can only use the first CPU (sonicwalls TZ line for example) SSL VPN is super heavy on CPU traffic. The log ingestion rate on Panorama is influenced by the platform and mode in use (mixed mode verses logger mode). By enabling this option, a device sends it's log to it's primary log collector, which then replicates the log to another collector in the same group: Log duplication ensures that there are two copies of any given log in the log collector group. Palo Alto Networks Device Framework. The Palo Alto NetworksTM PA-200 is targeted at high speed Internet gateway deployments within distributed enterprise branch offices. By continuing to browse this site, you acknowledge the use of cookies. Feb 07, 2023 at 11:00 AM. num-cpus: 4. Set Up The Panorama Virtual Appliance as a Log Collector. 2. Currently, the Overall Log ingestion rate will be reduced by up to 50%. Determining actual log rate is heavily dependent on the customer's traffic mix and isn't necessarily tied to throughput. Logging calculator palo alto networks - Environment. Can someone know how to calculate manually the FW Throughput ? The PA-200 manages network traffic flows . In order to calculate manually i have to add all receive or transmit interfaces traffic ? To set up the new MTU value, you can go under Network | Interfaces, select the WAN interface from which the VPN traffic is going through and: Navigate to Advanced t ab. Fan-less design. This numbermay change as new features and log fields are introduced. Clean, and Painted, 1 BR/1 BA, Downstairs Unit. Command 'show system statistics session' display a low value in comparison of snmp BW value graphs, how system statistics sessions > Throughput :133965 Kbps. Will the device handle log collection as well? $ 2,000 Deposit. You also want to consider if you are doing site to site or mobile VPN with your firewall solution. Speakers: Ramon de Boer, Palo Alto Networks Explore Palo Alto's sunrise and sunset, moonrise and moonset. This is based on theAzure infrastructure costs, VM-Series performance, Azure network bandwidth and required number of NICs. On spreadsheet the throughput value ( without ThreatP ) = 20 Gbs. Powers Palo Alto Networks offerings Facilitate AI and machine learning with access to rich data at cloud native scale. Radically simplify security operations by collecting, transforming and integrating your enterprises security data. VARs has engineers who do this for a living, contact them. Palo Alto also offers virtual, container and cloud firewalls, plus other features like AIOps and SD-WAN. Most sites I visit have an appropriately sized deployment, IMO. Section 0 defines a single dwelling unit as <spanstyle="font-style: italic;"="">"a dwelling unit consisting of a detached house, one unit of row housing, or one unit of a semi-detached . between subnets or application tiers inside a VNET. Procedure. Number of concurrent administrators need to be supported? Drives unprecedented accuracy Significantly improve . Which products will you be using? A lower value indicates a lower load, and a higher value indicates a more intense workload. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clc8CAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail, Created On09/25/18 19:43 PM - Last Modified03/02/23 20:22 PM. Ensure that all of these requirements are addressed with the customer when designing a log storage solution. external Network ---- 250 Mbps IN /OUT ------ FW PA5060 ------400 Mbps IN / OUT ----- DC Servers. Resolution. The Panorama solution allows for flexibility in design by assigning these functions to different physical pieces of the management infrastructure. ARP table size/device: 500 IPv6 neighbor table size: 500 MAC table size/device: 500 Palo ratings are quite conservative, and are pretty much the worst case scenario bandwidth wise. Bundle 2 contents: VM-300 firewall license, Threat Prevention (inclusive of IPS, AV, malware prevention), WildFire, URL Filtering and GlobalProtect subscriptions, and Premium Support (written and spoken English only). limit your VM-Series session capacities in Azure. Larger VM sizes can be used with smaller VM-Series models. For cloud-delivered next-generation firewall service, click here. Our new credit-based licensing enables on-demand consumption of software NGFWs and cloud-delivered security services without fixed firewall sizes or rigid service bundles. I want to receive news and product emails. With PAN-OS 8.0, the aggregated size of all log types is 500 Bytes. to VM-Series on Azure; from VM-Series on an Azure VNet to an Azure Latency matters: Network latency between collectors in a log collector group is an important factor in performance. here the IN OUT traffic for Ingress and Egress . There are several factors to consider when choosing a platform for a Panorama deployment. When in mixed mode, is capable of ingesting 10,000 - 15,000 logs per second. Firewalls require an acknowledgement from the Panorama platform that they are forwarding logs to. Oops! Larger VM types have more cores, more memory, more network interfaces, and better network performance in terms of throughput, latency and packets per second. Calculating the Size of a Firewall For Your Network February 24, 2022 We live in a world where security breaches and data losses are expected. Do this for several days to get an average. 240 GB : 240 GB . These factors are: Each of these factors are discussed in the sections below: The aggregate log forwarding rate for managed devices needs to be understood in order to avoid a design where more logs are regularly being sent to Panorama than it can receive, process, and write to disk. See 733 traveler reviews, 537 candid photos, and great deals for The Westin Palo Alto, ranked #11 of 29 hotels in Palo Alto and rated 4 of 5 at Tripadvisor. Log Storage Requirements: This is the timeframe for which the customer needs to retain logs on the management platform. it's for a PA 5060 with multiple Vsys and 1 etherchannel to the external network and another one for internal servers. The Threat database is the data source for Threat logs as well as URL, Wildfire Submissions, and Data Filtering logs.Note that we may not be the logging solution for long term archival. These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole! Does the customer require dual power supplies? Easy-to-implement centralized management system for network-wide traffic insight. /u/McKeznak made a funny about vendors trying to sell you the kitchen sink, but I don't believe this is the case with their NGFW product line. . Conversely, you can have a smaller throughput comprised of thousands of UDP DNS queries that each generate a separate traffic log. Bundle 1 contents: VM-300 firewall license, Threat Prevention (inclusive of IPS, AV, malware prevention) subscription and Premium Support (written and spoken English only). Facilitate AI and machine learning with access to rich data at cloud native scale. Check out the following article the goes into detail on the different methods used for sizing: https://live.paloaltonetworks.com/t5/Learning-Articles/Sizing-Storage-for-the-Logging-Service/ta-p/1 https://apps.paloaltonetworks.com/logging-service-calculator. If a larger VM size is used for the VM-Series, only the max CPU cores and memory shown in the table will be fully utilized, but it can take advantage of the faster network performance provided by Azure.VM-Series for Azure supports the following types of StandardAzure Virtual Machine types. Built for security operations Radically simplify security operations by collecting, transforming and integrating your enterprise's security data. For example: that a certain number of days worth of logs be maintained on the original management platform. SSD Size : 240 GB . . environment to ensure that your performance and capacity requirements This service is provided by the Application Framework of Palo Alto Networks. Storage for Detailed Logs: The amount of storage (in Gigabytes) required to meet the retention period for detailed logs. Plan for that if possible. There are several factors that drive log storage requirements. Perimeter and/or server/client? In early March, the Customer Support Portal is introducing an improved Get Help journey. deployment. View all your firewall traffic, manage all aspects of device configuration, push global policies, and generate reports on traffic patterns or security incidents - all from a single console. Panorama network security management enables you to control your distributed network of our firewalls from one central location. Something went wrong while submitting the form. Verify Remote Network Connection Status. PAN-OS 7.0 and later include an explicit option to write each log to 2 log collectors in the log collector group. New sessions per second are measured with 1 byte HTTP transactions. Try our cybersecurity innovations in complimentary, customized half-day workshops. The Palo Alto Networks PA-400 Series Series Next-Generation Firewalls, comprising the PA410, PA-415, PA-440, PA-445, PA-450, and PA-460, brings ML-Powered NGFW capabilities to distributed enterprise branch offices, retail locations, and midsize businesses. This allows for zone based policies north-south, i.e. My VAR is great, but their "palo guy" doesn't even know as much as I do because he's not on it daily. A brief overview of these two main functions follow: Device Management: This includes activities such as configuration management and deployment, deployment of PAN-OS and content updates. Azures networking provides user-defined route (UDR) tables to force traffic through the firewall. Copyright 2023 Palo Alto Networks. Spread ingestion across the available collectors: Multiple device forwarding preference lists can be created. The latency of intervening network segments affects the control traffic between the HA members. A cloud-delivered architecture connects all users to all applications, whether theyre at headquarters, branch offices or on the road. Flexible Panorama Design. You will need to stop the VM to change the size.Note:Azure VMs include a local/temporary disk that is meant to be used as swap disk and is not for persistent storage. 2023 Palo Alto Networks, Inc. All rights reserved. Do this for several days to get an average. The Panorama solution is comprised of two overall functions: Device Management and Log Collection/Reporting. Internet connection speed? But a common mistake is not calculating traffic in all directions. If Log Collector 1 becomes unreachable, the devices will send their logs to Log Collector 2. User-ID technology features enabled, utilizing 64 KB HTTP transactions. Right Sizing a Firewall - Understanding Connection Counts. Log collection for Palo Alto Networks Next Generation Firewalls 368+ Math Tutors 12 Years on market 84112 Completed orders Get Homework Help : 540 Gbps. About. These are: With PAN-OS 8.0, all firewall logs (including Traffic, Threat, Url, etc.) Hi i actually work for a consulting company. The numbers in parenthesis next to VM denote the number of CPUs and Gigabytes of RAM assigned to the VM. For example, a single offloaded SMB session will show high throughput but only generate one traffic log. 500 Mbps. Note thatfor both the 7000 series and 5200 series, logs are compressed during transmission. The changes are based on direct customer feedback enabling users to navigate based on intents: Product Configuration, Administrative Tasks, Education and Certification, and Resolve an Issue, Copyright 2007 - 2023 - Palo Alto Networks, Enterprise Data Loss Prevention Discussions, Prisma Access for MSPs and Distributed Enterprises Discussions, Prisma Access Cloud Management Discussions, Prisma Access for MSPs and Distributed Enterprises, Network Throughput Graphs are incoherent in PA-220. Log Collection for GlobalProtect Cloud Service Mobile User. 1968 Year Built. Artificial Intelligence for IT Operations, Workload Protection & Cloud Security Posture Management, Application Delivery and Server Load-Balancing, Digital Risk Protection Service (EASM|BP|ACI), Content Security: AV, IL-Sandbox, credentials, Security for 4G and 5G Networks and Services, FORTINET NAMED A LEADER IN THE 2022 GARTNER MAGIC QUADRANT FOR NETWORK FIREWALLS. Our SE, on the other hand, built a sizing tool to pull in data (either straight numbers from another firewall, or import a csv report with certain criteria from a palo device) to size and can include potential added load from decrypt. These concerns are network latency and throughput. When planning a log collection infrastructure, there are three main considerations that dictate how much storage needs to be provided. The changes are based on direct customer feedback enabling users to navigate based on intents: Product Configuration, Administrative Tasks, Education and Certification, and Resolve an Issue, Sizing Storage Using the Logging Service Calculator, Copyright 2007 - 2023 - Palo Alto Networks, Enterprise Data Loss Prevention Discussions, Prisma Access for MSPs and Distributed Enterprises Discussions, Prisma Access Cloud Management Discussions, Prisma Access for MSPs and Distributed Enterprises, Prisma "cloud code security" (CCS) module, NEW: Cortex XSIAM Resources on LIVEcommunity, How to Use Cortex XDR to Monitor Cryptojacking Malware, Choosing the Right Metadata for Phishing and Email Incidents, DOTW: TCP Resets from Client and Server aka TCP-RST-FROM-Client, Cortex XSOAR: Archiving Hosted Data for XSOAR 6, TLP Update (2.0), Going Softer on AMBER and Adding AMBER+STRICT. Focus is on the minimum number of days worth of logs that needs to be stored. Collector 2 will buffer logs that are to be stored on Collector 1 until it can pull Collector 1 out of the rotation. Per user log generation depends heavily on both the type of user as well as the workloads being executed in that environment. Palo Alto Networks Logging Service exists as a cloud-based storage mechanism for logs generated by the security platform. To start off, we should establish what a dwelling unit is. Tunnels? Application tier spoke VCN. The table below shows the ingestion rates for Panorama on the different available platforms and modes of operation. Current local time in USA - California - Palo Alto. When this happens, the attached tools will be updated to reflect the current status. Palo ratings are quite conservative, and are pretty much the worst case scenario bandwidth wise. Quickly determine the storage you need with our simple online calculator. We also included a Logging Service Calculator. For example: that a certain number of days worth of logs be maintained on the original management platform. This means that if your environment is significantly busier than the average, it is a simple matter to add whatever storage is necessary to meet your retention requirements. Panorama high availability is Active/Passive only and both appliances need to be fully licensed. A script (with instructions) to assist with calculating this information can be found is attached to this document. By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. Performance and Capacities1. We also included a Logging Service Calculator. If i have a chance i do SLR for them. Configure Prisma Access for NetworksAllocating Bandwidth by Location. Use the tables throughout this Palo Alto Networks Compatibility Matrix to determine support for Palo Alto Networks next-generation firewalls, appliances, and agents. Maestro Scalability (NGTP Gbps) - - up to 90 : up to 125 . View Disk space allocated to logs. . This information can provide a very useful starting point for sizing purposes and, with input from the customer, data can be extrapolated for other sites in the same design. This article will cover the factors below impact your Azure VM size: When sizing your VM for VM-Series on Azure, there are many factors to consider including your projected throughput (VM-Series model), the deployment type (e.g., VNET to VNET, hybrid cloud using IPSec or Internet facing) and number of network interfaces (NIC). In my experience the last couple years using Palo Alto's when it comes to sizing the number one metric that seems to cripple PA firewalls is the number of new connections per second. For in depth sizing guidance, refer to Sizing Storage For The Logging Service. Created with Lunacy. The higher resource availability will handle larger configurations and more concurrent administrators (15-30). If your organization or organizational needs are not represented in this calculator, please contact a Palo Alto Networks representative for . Additional interfaces may help segment and protect additional areas like DMZ. In the Logging Service, both threat and traffic logs can be calculated using a size of 1500 bytes. They can do things that VARs who aren't as experienced with Palo won't know to do. Otherwise, register and sign in. Command 'show system statistics session' display a low value in comparison of snmp BW value graphs. MX device utilization calculation The device utilization data reported to the Meraki dashboard is based on a load average measured over a period of one minute. > show system info. Aug 15th, 2016 at 12:01 PM check Best Answer. . When purchasing Palo Alto Networks devices or services, log storage is an important consideration. 0. Here is the spec sheet link for their current products: https://www.paloaltonetworks.com/resources/datasheets/product-summary-specsheet, This guide is also helpful with some of the math for log retention and other considerations: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clc8CAC. * Refers to recommended size based on CPU cores, memory, and number of network interfaces.Note: The VM-50 model is not supported on Azure.In most common usage scenarios D3 or D3_v2, and D4 or D4_v2 are the recommended VM sizes on Azure. Now you also need to consider if you are doing UTM (virus scan/spam filter/etc) on the firewall. The Active-Secondary will merge the configuration sent by the Active-Primary and enqueue a job to commit the changes. This website uses cookies essential to its operation, for analytics, and for personalized content. Palo Alto Firewalls (All Series) VM Firewall Any PAN-OS Cause Larger config size can cause firewall memory and CPU utilization to spike at the time of commits. These rules are set on a per subnet basis and send all outbound traffic of the subnet to a specific IP address of the firewall. The VM-Series model you choose for a BYOL deployment should be based on the capacities of the models and deployment use case. Be sure to include both business and non-business days as there is usually a large variance in log rate between the two. We are not officially supported by Palo Alto Networks or any of its employees. 2. SNMP OID Interface Throughput per Interface. Resolution PA-200: 10MB (larger sizes are unsupported according to Engineering) PA-500/PA-800/PA-VM/PA-400/PA-220: 10MB PA-3000/PA-3200: 20MB PA-5000: 30MB PA-5200/PA-5400: 45MB When a change is made and committed on the Active-Primary, it will send a send a message to the Active-Secondary that the configuration needs to be synchronized. According to a study done by IBM Security and the Ponemon Institute, the average cost of a data breach (from a sample of 500 companies interviewed) is $3.86 million. Many customers have a third party logging solution in place such as Splunk, ArcSight, Qradar, etc. Could you please explain how the thoughput is calculated ? Firewalling 27 Gbps. For sizing, a rough correlation can be drawn between connections per second and logs per second. Create a Deployment Profile Renew Your Software NGFW Credits Amend and Extend a Credit Pool Deactivate a Firewall Delicense Ungracefully Terminated Firewalls Register the VM-Series Firewall (Software NGFW Credits) Register the VM-Series Firewall (with auth code) IPsec VPN performance is tested between two VM-Series in When purchasing Palo Alto Networks devices or services, log storage is an important consideration. Be sure to include both business and non-business days as there is usually a large variance in log rate between the two.. Use data from evaluation devices. Palo Alto Firewall. There are three different cases for sizing log collection using the Logging Service. If there is a maximum number of days required (due to regulation or policy), you can set the maximum number of days to keep logs in the quota configuration. The free version is good but you need to pay for the steps to be shown in the premium version. The calculator will display the recommended storage size for you based on the products you selected and the details you've specified: You must be a registered user to add a comment. High availability with active/active and active/passive modes. When using this method, get a log count from the third-party solution for a full day and divide by 86,400 (number of seconds in a day). VM-Series logs are stored on the OS disk VHD in the Azure storage account used at time of deployment; swap disk is not used by VM-Series. What features do you want to use on the firewall, for example SSL decryption or IPSec tunneling? The other piece of the Panorama High Availability solution is providing availability of logs in the event of a hardware failure. If you've already registered, sign in. Firewall throughput (App-ID enabled)2, 4. Unique among city organizations, the City of Palo Alto operates a full-array of services including its own gas, electric, water, sewer, refuse and storm drainage provided at very competitive rates for its customers. Desktop : 1U . The hub VCN is a centralized network where Palo Alto Networks VM-Series firewalls are deployed. Open some TAC cases, open some more. Panorama Sizing and Design Guide. network topology, that is, whether connecting on-premises hardware The log sizingmethodologyfor firewalls logging to the Logging Service is the same when sizing for on premise log collectors.