Generated custom reports have different results

[Alvin-Lin]

Hello,

I have a PA-3250 with version 9.1.11-h3.

I have generated the August monthly reports on 9/13 and 9/16.

I noticed the report generated on 9/13 has less traffic than 9/16.

Could someone tell me the theory or reason why did this happend ?

Thanks. 

  

[reaper]

what is the source for the report: did you select a summary database or detailed logs?

in both case pruning could be an issue, is your log retention more than 45 days?

[Alvin-Lin]

Thanks for your reply.

Here is my settings.

traffic: Logs and Indexes: 36G Current Retention: 7 days
threat: Logs and Indexes: 5.6G Current Retention: 1085 days
system: Logs and Indexes: 1.3G Current Retention: 1107 days
config: Logs and Indexes: 1.5G Current Retention: 1107 days
alarm: Logs and Indexes: 24K Current Retention: 0 days
trsum: Logs and Indexes: 8.2G Current Retention: 58 days
hourlytrsum: Logs and Indexes: 3.6G Current Retention: 10 days
dailytrsum: Logs and Indexes: 1.2G Current Retention: 18 days
weeklytrsum: Logs and Indexes: 1.2G Current Retention: 88 days
thsum: Logs and Indexes: 2.4G Current Retention: 509 days

[reaper]

since your trsum is 58 days (an you're using the traffic summary as a source in the report) i don't know why you're seeing a different

are those the generated reports or the 'run now' ? run now could have some small discrepancies as it's pulled from live data, scheduled should be identical every time

in case of the latter, you may want to reach out to support to have this investigated

[Alvin-Lin]

It's scheduled. So I think it weird.

Thank You again, if I couldn't get the answer from here, I will open a case to find the answer for why this happended.