topic Re: custom report - "unknown" category in General Topics

custom report - "unknown" category

_slv_ — Tue, 15 Aug 2017 18:39:48 GMT

Hello

I observed that in my reports in pdf I have a lot of "unknown" in CATEGORY column.

My report looks like:

How is possible that google-base or linkedin-base have category=unknown ?

Regards

Slawek

Re: custom report - "unknown" category

Remo — Tue, 15 Aug 2017 19:00:38 GMT

Hi @_slv_

What were the actual URLs behind these entries in your report?

The app that PaloAlto sees does not have to be related to the URL where your users connect to. So depending on the actual signature it might be possible that you see these apps on totally different websites.

The other possibility of this behaviour is that there were problems of your firewall in the url cache.

You should also check on the CLI the URL DB status of these websites.

Re: custom report - "unknown" category

_slv_ — Wed, 16 Aug 2017 14:00:07 GMT

Hello @Remo

some CLI output

admin@PA-500> debug device-server bc-url-db db-info

brightcloud db:

type    : brightcloud_md5_db
desc    : version_2.2.0
version : 20170815
dataline: 0020000000

umd5 base db:

version: 5.284
db date: 20170815

No bloom filter found for base db


admin@PA-500> debug device-server bc-url-db show-stats

BC URL DB access counters:
  Total requests: 9222 (65% unknown)
  DB file lookup hit: 3219, miss 17444, total 20663
  cache enabled: no


admin@PA-500> debug device-server bc-url-db bloom-verify-basedb

bloom isn't built
Test bloom failed


admin@PA-500> debug device-server bc-url-db bloom-stats

No bloom filter found for base db

I'm new to url reports ... should do I enable cache ? (I think - yes) but what about "bloom" - what is that?

>What were the actual URLs behind these entries in your report?

I need some time to verify that

Regards

Slawek

Re: custom report - "unknown" category

_slv_ — Thu, 17 Aug 2017 19:31:35 GMT

Hello

Some new info (from Monitori>URL filtering)

Any idea why there is "unknown" ?

Regards

SLawek

Re: custom report - "unknown" category

BPry — Fri, 18 Aug 2017 03:37:20 GMT

@_slv_,

I would do as @Remo suggested and clear my URL-cache and let it rebuild prior to troubleshooting this any further. You can check what category any URL should be categorized as if your cache is working correctly by going HERE . The outlook.office365.com should get categorized as Computer and Internet Info if everything is working correctly.

Re: custom report - "unknown" category

_slv_ — Fri, 18 Aug 2017 07:04:13 GMT

I did :

admin@PA-500> clear url-cache all

All entries in URL cache removed!


admin@PA-500> delete url-database all

This command requires the Palo Alto Networks URL filtering database.


admin@PA-500> test url www.paloaltonetworks.com

www.paloaltonetworks.com computer-and-internet-security (Cloud db)


admin@PA-500> test url outlook.office365.com

outlook.office365.com computer-and-internet-info (Cloud db)

We will see if that fix reports or not...

Re: custom report - "unknown" category

_slv_ — Fri, 18 Aug 2017 07:21:57 GMT

Stil is something wrong in my opinion

admin@PA-500> test url www.decathlon.de

www.decathlon.de shopping (Dynamic db)

when

Re: custom report - "unknown" category

_slv_ — Fri, 18 Aug 2017 07:50:00 GMT

I found solution !!! link

show running top-urls category unknown

now shows some url but not very common like before.

Thx all for help

Regards

Slawek

Re: custom report - "unknown" category

Remo — Mon, 21 Aug 2017 17:46:49 GMT

So you simply had to enable "dynamic URL filtering" in your URL profile?

Re: custom report - "unknown" category

_slv_ — Mon, 21 Aug 2017 17:51:57 GMT

Not only, also I added

# set deviceconfig setting url dynamic-url yes

to my configuration

Regards

Slawek