How to parse GlobalProtect usernames from the System log for something like emailing a list of users

Reply
Highlighted
L4 Transporter

How to parse GlobalProtect usernames from the System log for something like emailing a list of users

How to parse GlobalProtect usernames from the System log for something like emailing a list of users

 

  1. On the PA’s Monitor Tab click on System
  2. Enter this search string
    1. ( description contains 'authenticated for user') and ( description contains 'LDAP-sAM-attribute' ) -substitute LDAP-sAM-attribute with your auth profile used specifically for the GlobalProtect authentications or use another unique contains string to limit your results to only GP users
  3. Click the Excel icon to begin the export
  4. Download the file when completed
  5. Open Excel and create a new spreadsheet
  6. Select Data | Get External Data | Import from Text File
  7. Browse to your downloaded PA firewall export CSV log file and Get Data
  8. On the Text Import Wizard select Delimited and Start import at row 2
  9. Click Next
  10. Be sure that no delimeters are selected
  11. Check the Other: box and enter an apostrophe ‘
  12. Now you will see a preview of the data to be imported
  13. For the Column data format select (Skip) for all columns except for the column that has the usernames in it.
  14. Now click Finish and OK to import in the existing sheet at the cell you would like to start with, typically =$A$1
  15. Optionally you could just import ‘as is’ and delete the columns you don’t need.
  16. Now we must remove any duplicates
  17. Select your column of usernames
  18. Click on Data and Remove Duplicates | Remove Duplicates
  19. Now you may copy that column and paste it into an email recipients list
  20. Click “Check Names” to verify the users match existing address book users and eliminate any that were not found.
  21. Draft your message and SEND!
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!