topic Re: User Activity Report in General Topics

User Activity Report

grant_sturgis — Mon, 14 Jun 2010 15:33:04 GMT

Hey folks,

Just installed my first PAN firewall - after running an eval unit for about a month. Loving it so far, but still learning...

First question for this board - hope it's not a dumb one.

We're running 3.0.9 and pan-agent and that seems to be working fine. In Traffic log and URL Filtering log user ID seems to be working fine. The problem I'm running into is that I can't seem to get the User Activity Report to work at all. The logs report the username as:

domain\username

So I tried that first in the "user" field of the report, but I also tried DOMAIN\username and just plain username.

Any troubleshooting tips or suggestions here?

Many thanks,

Grant

-------------------

Re: User Activity Report

kbrazil — Mon, 14 Jun 2010 16:20:49 GMT

Hi Grant,

I noticed that when I copy and paste the username in through certain browsers a trailing space would be included. Any extra spaces will keep the report from being properly generated. A small thing but it has bitten me in the past.

Also, I have heard of some minor PAN Agent issues with 3.0.9 PANOS but this was revolving around policy creation, not logging or reporting. If the above suggestion doesn't work, I wonder if downgrading to 3.0.8 might help.

Cheers,

Kelly

Re: User Activity Report

grant_sturgis — Mon, 14 Jun 2010 16:33:39 GMT

Nope, that's not it. I'm typing it in, not copy and paste.

We are using version 3.1.0 of the agent, could that be the problem? Seems unlikely since User ID in general is working fine.

Re: User Activity Report

kbrazil — Mon, 14 Jun 2010 16:40:21 GMT

If the usernames are showing up in the logs, then it seems it should be working. First, try upgrading to 3.1.2. Also try generating the report via IP address instead of username and see if that works. If neither of those help, you may need to contact support.

Cheers,

Kelly

Re: User Activity Report

grant_sturgis — Tue, 15 Jun 2010 16:08:34 GMT

The problem here was that I was choosing "Last Calendar Day" for the time frame, while the user had no activity. Once I switched that to "Last 12 Hours", it worked fine.