How to Disable Predefined Reports on a Palo Alto Networks Device

PAN-OS 6.0 and later

Overview

Every PAN-OS distribution has around 40 predefined reports that are automatically generated and available to administrators. These reports make up a helpful tool, and allows traffic visibility in the network. It also gives the designated recipients the most common reports to manage threats that are targeting the network.

Details

In some scenarios, it may be desirable to disable the predefined reports that are on the Palo Alto Networks devices. For example, the device may be busy and the predefined reports generate more management plane (MP) CPU usage. Another reason to disable the predefined reports is the configuration and use of custom reports. In PAN-OS 6.0, all reports (predefined reports, specific reports, a group of reports) can be disabled by a Palo Alto Networks firewall administrator.

Steps

The predefined reports can be disabled from the web UI or from the CLI, and the process is the same for Palo Alto Networks firewall and Panorama.

On the web UI:

1. Go to Device > Setup > Management on the firewall, or Panorama > Setup > Management on Panorama
2. Select Logging and Reporting Settings and go to the Log Export and Reporting tab
3. Uncheck the reports that are not needed, or choose Deselect All to stop all predefined report generation
4. Commit the changes
   

On the CLI:

1. Enter a configuration mode
   > configure
2. Disable the automatic generation of unwanted reports
   # set deviceconfig setting management disable-predefined-reports <name-of-report>
   Note: Use the tab key at the end of the command to see the full list of reports that can be disabled. If some of the disabled predefined reports are included in a Report Group (under Monitor > Report Groups), the named report will be empty. It is recommended to remove the report from the list in the Report Group.
3. Commit the configuration
   # commit

owner: ialeksov