Custom Report Oddity in PanOS 4.0.1

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Custom Report Oddity in PanOS 4.0.1

Not applicable

I have the following report configured and it is checked "scheduled" in Panorama

Soft Block Report {

  type {

    panorama-url {

      group-by day-of-receive_time;

      aggregate-by [ risk-of-app action category srcuser src misc ];

      values [ repeatcnt ];

    }

  }

  period last-7-calendar-days;

  topn 500;

  topm 10;

  frequency daily;

  query (action eq continue);

}

I can logically deduce from this information that "scheduled" means run this report daily which isn't really what I want but it seems to be the only option.


I have the following email-scheduler configured

email-scheduler {

  Soft Block {

    report-group Soft Block Report;

    email-profile Corporate Compliance;

    recurring {

      weekly monday;

    }

  }

}

Unless I've misunderstood something this means Panorama should email the defined report once a week on Monday.  This used to work correctly running 3.1.6, since upgrading to 4.0.1 the email goes out every day and while the date range in the report says it is for the previous 7 days it is in fact only a report of the previous day.


Any suggestions as to why this is happening?

1 REPLY 1

L4 Transporter

Hello,

Soft Block Report {

  type {

    panorama-url {

      group-by day-of-receive_time;

      aggregate-by [ risk-of-app action category srcuser src misc ];

      values [ repeatcnt ];

    }

  }

  period last-7-calendar-days;

  topn 500;

  topm 10;

  frequency daily;

  query (action eq continue);

}

The first half of your post Creates the xml files used by the second half. We take this xml file convert it to PDF and then email it.

At the conclusion of the first schedule there will be a viewable output that you can see from its link under custom reports. The first step to troubleshooting this is to view the xml, does it have all the data expected? If yest then we need to determine why it is altered when scheduled and emailed.

email-scheduler {

  Soft Block {

    report-group Soft Block Report;

    email-profile Corporate Compliance;

    recurring {

      weekly monday;

    }

  }

}

Now the second part is the schedule, based on this it should be converting your XML and then sending it out each monday. Was this report migrated from 3.1.6 in the upgrade process or did you re-create it?

If its not running at the expected time I would suggest you contact support and have them look over your setup.

~Phil

  • 1569 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!