topic Re: Generate Traffic Report on PA Firewall 7 Months Ago? in General Topics

Generate Traffic Report on PA Firewall 7 Months Ago?

searching1 — Thu, 01 Dec 2016 08:18:01 GMT

Hi All,

Tried generating traffic report from month of May. But, Under Manage Custom Reports > Run now "Result was No Matching Records"

Report Setting are:

Database: Traffic Log

Time Frame: May1-31

Sortby: Top 500

Group by: 25 Groups

Selected Columns: Destination zOne

Do you think we can still see those logs?

For PA Admin. How long would our PA device store logs?

thanks

Re: Generate Traffic Report on PA Firewall 7 Months Ago?

kiwi — Thu, 01 Dec 2016 09:32:05 GMT

Hi @searching1,

That depends on your logging rate vs capacity and can vary quite a bit. At high traffic rates your FW will only hold a couple of hours/days/weeks of logs.

Change the direction of the logs to see the oldest traffic log on your device using the drop down menu at the bottom right :

Alternatively you can use the CLI command 'show log traffic direction equal forward' to check for your oldest log on the device.

If you want to store data for longer times then I'd recommend using a log-collector or syslog server.

Cheers,

-Kim.

Re: Generate Traffic Report on PA Firewall 7 Months Ago?

santonic — Thu, 01 Dec 2016 12:02:01 GMT

"show system logdb-quota" will show you retention period for every log.

Re: Generate Traffic Report on PA Firewall 7 Months Ago?

BPry — Thu, 01 Dec 2016 13:52:11 GMT

As others have stated it all depends on how much space you've allocated for logging data. Depening on our traffic flow on our main unit I can have 1-2 days of logging, or I can get just a few hours of logs depending on the amount of traffic flowing through.