topic Re: Different data in ACC reports and custome created report in General Topics

Different data in ACC reports and custome created report

rubber_ducky — Fri, 13 Aug 2021 07:16:57 GMT

Helo Everybody,

I have created a custom report in Panorama to generate the same data that we get in ACC - Application usage report, for last one month. But it looks like the data in the custom report is always different than that which is genereated in acc widget/report.

Re: Different data in ACC reports and custome created report

kiwi — Fri, 13 Aug 2021 13:01:11 GMT

Hi @rubber_ducky ,

On which platform and OS are you seeing this ?

Cheers,

-Kiwi.

Re: Different data in ACC reports and custome created report

rubber_ducky — Fri, 13 Aug 2021 13:08:32 GMT

Panorama - sosftware version 9.1.5

Re: Different data in ACC reports and custome created report

kiwi — Fri, 13 Aug 2021 13:46:54 GMT

Hi @rubber_ducky ,

Have you tried comparing these results over a shorter period of time ? The problem with ACC is that there's a limitation of 100K lines and it might not contain the full amount of data.

When you query ACC stats for a month, the result is generated by aggregating weekly, daily and hourly summary databases. There is however a limit imposed on this aggregation ... which is 100k lines. So once the limit is reached the report might not contain all the data:

Check this link for details:

ACC is Not Accurate During Heavy Traffic Log Generation

That being said, I would also recommend upgrading your OS version to 9.1.10 which is the preferred release at the moment of me writing this... just to rule out possible bugs that might have been resolved in newer OS versions :

PAN-OS Software Release Guidance

Cheers,

-Kiwi.

Re: Different data in ACC reports and custome created report

rubber_ducky — Fri, 13 Aug 2021 14:23:10 GMT

Thank you for the response.

So do you mean that the custom report data is more accurate. I had filtered for 5 June 12 AM - 5 July 12 AM in ACC. Can I conider the custom report info to be more accurate and continue to use that. Also in ACC widget, it shows the top 10 and then "others" which has the rest of the applications which I can see when I maxmize the widget.

The requirement was just the top 10 so I had generated the custome report for only top 10 applications and for same time frame like I used in ACC, 5 June 12 AM - 5 July 12 AM.