When a Custom Report is scheduled through the Email Scheduler, it appears to be different from a report generated from the WebGUI. Shown below are two Custom Report examples. (GUI: Monitor > Manage Custom Reports)
These Reports are in the Report Groups under GUI: Monitor > PDF Reports > Report Groups.
Email Scheduler is used to send Reports from this report Group using GUI: Monitor > PDF Reports > Email Scheduler.
The Custom Report generated from the WebGUI looks like this:
The Custom Report sent from the Email Scheduler looks like this:
The report generated from the WebGUI appears as expected, but the report from the Email Scheduler is missing some data and does not appear the same.
Environment
Palo Alto Firewall.
Any PAN-OS.
Custom Reports.
Cause
When configuring the Report Group, there are 2 options to choose a report from. One is under the "custom report" tree and the other is from the "log view" tree.
If "custom report" tree is selected only the report will be sent without all of the log data.
If "log view" tree is selected, all logs corresponding to the report will be sent in the pdf report.
Report Group detail, showing the Custom Report and Log View options.
Resolution
To display all of the data from the logs in the Emailed Reports, go to GUI: Monitor > PDF Reports > Report Groups and select the report from under the "Log View" tree instead of the "Custom Report".
Additional Information
Panorama does not include the "Log View" option, so you will have to rely on the reports from the Firewall directly if you would like this data.