Global protect External gateway in remote user time format issue
cancel
Showing results for 
Search instead for 
Did you mean: 

Global protect External gateway in remote user time format issue

L4 Transporter

 In global protect I want to see the Total number of user are Login in and Log out at which time. In Global-protect Gateway when i click on remote user i see current and previous user  connected to through VPN. When i fetch PDF/ CSV file. In file the time it will see correct but when i downlaod this file the  format is change like 15182019 for login and 151824324 for logout. Please suggest how can i correct this.

 

Source RegionTunnel TypeLogin AtLogout At
INIPSec15815176271581517638
AEIPSec15850374441585063472
OMIPSec15825207431582525272
INIPSec15815176031581517611
AEIPSec15850575461585058982
AEIPSec15849642361584968502
AEIPSec15843803011584389687
AEIPSec15844271681584427383
AEIPSec15850374481585062715
INIPSec15832419651583242314
1 ACCEPTED SOLUTION

Accepted Solutions

L4 Transporter

The time is displayed as "seconds since 1970-01-01 00:00:00 UTC". If you run on a Linux system

date --date=@1581517627

you will have the date and time based on your local timezone

Wed 12 Feb 2020 03:27:07 PM CET

I bet there are better ways to translate the timestamp back into something readable. The formula in Excel is something like "=(A1-Date (1970,1,1)) *86400"

View solution in original post

6 REPLIES 6

L4 Transporter

The time is displayed as "seconds since 1970-01-01 00:00:00 UTC". If you run on a Linux system

date --date=@1581517627

you will have the date and time based on your local timezone

Wed 12 Feb 2020 03:27:07 PM CET

I bet there are better ways to translate the timestamp back into something readable. The formula in Excel is something like "=(A1-Date (1970,1,1)) *86400"

View solution in original post

Hi JoergSchuetter,

 

I have the similar issue after exporting out my Global Protect Remote user list.

I try your solution to input your formula "=(A1-Date(1970,1,1))*86400" inside a new cell in excel, where :-

 i) A1 is the value of the user login date become numbers (eg. 1586828881)

 

The result is exponential figures. (eg.  1.37E+14)

 

I change the multiply (*) to division (/) "=(A1-Date(1970,1,1))/86400, it looks more like a date after formatting.

The problem is, I got the "day" 2 days earlier and the "year" 70 years earlier.

For example, login date = 14/4/2020. After the formula, I got login date = 12/4/1950

 

I am using Palo-Alto FW P3020. Can you advise further ? Thanks. 

looks like the issue is addressed with PAN-126014 (which is solved in 9.0.7, but I couldn't spot this fix for 8.1.x)

Fixed an issue for GlobalProtect gateways where the Login At and Logout At time fields in the Previous User PDF/CSV report for User Information used the Epoch standard for displaying time.

 

Thanks for your quick reply.

Is there a solution without upgrading PAN OS?

 

Thanks,

Gerry

L0 Member

We are also facing same issue, as per palo alto support team, need to upgrade OS to 9.0.13, current using 9.0.3,

 

If you want to you can get vpn user login and logout details via cmd, run "show global-protect-gateway previous-user"  then copy all data on notepad.

Thanks !!
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!