Firewall reporting storage by firewall model
The amount of storage that you can allocate depends on the firewall model.
Firewall reporting licensing is divided into two tiers: Central Firewall Reporting and Central Firewall Reporting Advanced.
Central Firewall Reporting
Reporting on your firewall is free when you have any other active firewall subscription. However, if you don't buy any reporting licenses for a firewall, you have only a small amount of storage, which varies according to the firewall model. With this type of license, you can store data for up to seven days. When you have free firewall reporting, no firewall reporting license is shown in your Sophos Central licenses.
Central Firewall Reporting Advanced
When you purchase an active Xstream Protection bundle, you get a limited Central Firewall Reporting Advanced license. You can store data for up to 30 days before it's deleted. No firewall reporting license is shown in Sophos Central under Product licenses. However, the Xstream Protection bundle is shown in Sophos Central under Firewall licenses.
Note
You don't need to manage your firewall subscriptions in the same Sophos Central account where the reporting logs are sent.
When you purchase reporting licenses, you have more storage, which varies according to the firewall model. In addition, you can store data for up to 365 days before it's deleted. There are two types of advanced licenses: regular and MSP. Your Central Firewall Reporting licenses are shown in Sophos Central under Product licenses. Click Manage next to Central Firewall Reporting to allocate licenses to your firewalls and manage your licenses.
Note
In all cases, storage is limited by the max storage or max storage period, whichever is reached first. After this, the oldest data is no longer stored. Data is deleted on a first-in, first-out basis.
To calculate the amount of storage you need, use our storage estimation tool: Sophos Central Firewall Data Storage Estimation Tool.