historical user active reports

[mscanlon]

Can someone tell me how far back you can expect to be able to run a user activity report ?

[rmonvon · Accepted solution]

You can select the time period to run the User Activity Report (UAR) and the system will query the database to run the report.  The size of the log database is determined by this CLI command:

admin@ca4demo> show system logdb-quota

total log disk size: 50 GB
quotas:
    traffic: 32%, 16 GB
    threat: 16%, 8 GB
    system: 4%, 2 GB
    config: 4%, 2 GB
    appstat: 12%, 6 GB
    trsum: 12%, 6 GB
    thsum: 4%, 2 GB

.....

You can see how far back the log can go by checking for the oldest log entry via CLI command 'show log ...'.  In this output, the url log can go back to 2010/07/07.

admin@ca4demo> show log url

Time                App             From            Src Port   Source
Rule                Action          To              Dst Port   Destination
Severity            Src User        Dst User        Threat
===============================================================================
2010/07/07 17:00:06 web-browsing    tapzone         4979      10.154.7.14
Monitor ALL         alert           tapzone         80        76.13.208.11
info                pancademo\david                 (9999)