topic Re: Global Protect still lacks detail reporting feature in General Topics

Global Protect still lacks detail reporting feature

vtan — Wed, 14 Feb 2018 20:26:46 GMT

Greetings,

So, I have a ticket open with support requesting on detailed reporting as seen on Network --> Global Protect --> Gateways --> Remote user link --> remote user tab, but on a cumulative basis instead of just data from the last login session.

I searched around and found two links:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Run-a-Report-for-Previous-Logged-in-GlobalProtect-Users/ta-p/52846

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Check-User-Access-by-GlobalProtect-for-Specific-Time/ta-p/54329

The first link allowed me to export the data to a csv format, but lack the details as provided by the "remote user" link, especially the logout time. These links dated back to 2013/2014 respectively, and I have not seen any progress from PAN on providing a proper detailed reporting.

Does anyone out there have a solution, so I can make a query on when a user logged in, logged out, the frequency of that particular using GP, session utilization, etc? I am assuming one could remote syslog the data and use splunk to generate the proper report. However, I hope someone has an easier method to obtain the required reporting...

Thank you.

Re: Global Protect still lacks detail reporting feature

Mick_Ball — Thu, 15 Feb 2018 09:21:16 GMT

not much help but for frequency I do use syslog.

all 36 of our gateways log to the same syslog server so this saves me having to remote to each PA for logon stats.

i run my own reports using grep & sed, these are then csv'd and passed to various departments for audit/charging...

It has always been a gripe of mine that this information is not collected by panorama......

I did try to run custom reports on GP allocated addresses and zones but got a bit messy, perhaps if i understood the reporting side better I may have succeeded but this will then only assume user logon time, not actually display it...

looking forward to a solution here.....

Re: Global Protect still lacks detail reporting feature

vtan — Thu, 15 Feb 2018 16:38:53 GMT

Looks like there is a submitted feature request (ID 533), but nobody can tell me if PAN is even showing interest in making it available in the next release. I'm trying to be that squeeky wheel to push them over the edge to do so...