topic Re: Generated custom reports have different results in General Topics

Generated custom reports have different results

Alvin-Lin — Thu, 21 Sep 2023 06:53:38 GMT

Hello,

I have a PA-3250 with version 9.1.11-h3.

I have generated the August monthly reports on 9/13 and 9/16.

I noticed the report generated on 9/13 has less traffic than 9/16.

Could someone tell me the theory or reason why did this happend ?

Thanks.

Re: Generated custom reports have different results

reaper — Wed, 20 Sep 2023 12:50:50 GMT

what is the source for the report: did you select a summary database or detailed logs?

in both case pruning could be an issue, is your log retention more than 45 days?

Re: Generated custom reports have different results

Alvin-Lin — Thu, 21 Sep 2023 06:52:28 GMT

Thanks for your reply.

Here is my settings.

traffic: Logs and Indexes: 36G Current Retention: 7 days
threat: Logs and Indexes: 5.6G Current Retention: 1085 days
system: Logs and Indexes: 1.3G Current Retention: 1107 days
config: Logs and Indexes: 1.5G Current Retention: 1107 days
alarm: Logs and Indexes: 24K Current Retention: 0 days
trsum: Logs and Indexes: 8.2G Current Retention: 58 days
hourlytrsum: Logs and Indexes: 3.6G Current Retention: 10 days
dailytrsum: Logs and Indexes: 1.2G Current Retention: 18 days
weeklytrsum: Logs and Indexes: 1.2G Current Retention: 88 days
thsum: Logs and Indexes: 2.4G Current Retention: 509 days

Re: Generated custom reports have different results

reaper — Thu, 21 Sep 2023 11:43:15 GMT

since your trsum is 58 days (an you're using the traffic summary as a source in the report) i don't know why you're seeing a different

are those the generated reports or the 'run now' ? run now could have some small discrepancies as it's pulled from live data, scheduled should be identical every time

in case of the latter, you may want to reach out to support to have this investigated

Re: Generated custom reports have different results

Alvin-Lin — Fri, 22 Sep 2023 02:04:38 GMT

It's scheduled. So I think it weird.

Thank You again, if I couldn't get the answer from here, I will open a case to find the answer for why this happended.