How to generate GlobalProtect VPN Reports

[bhakti1213]

Is there any way to provide reporting for GlobalProtect remote access VPN. Like for example I want a report of users who have connected in the past week, etc. How do i generate those reports?

[kiwi]

Hi @bhakti1213,

I found the following article about this :

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Run-a-Report-for-Previous-Logged-in-...

Cheers !

-Kiwi.

[bhakti1213]

Will this allow me to generate the reports? Like for example a report covering a week with concurrent users per hour?

[Mick_Ball]

I never found any way of doing this on the PA itself.

I send to syslog and then run linux scripts to search files for succesful gateway auths and group them in date chunks.

no great detail is available but all of our departments pay for the VPN service and they like to know who is actually using it, when they used it and how often...

I also run scripts that use curl to call API's to monitor connections per gateway on a regular basis.

[bhakti1213]

Does anyone know if there is a way to schedule GlobalVPN reports, I found a way of generating them just like the artlice shows, but is there a way to shcedule them?

[bhakti1213]

Does anyone know if there is a way to schedule GlobalVPN reports, I found a way of generating them just like the artlice shows, but is there a way to shcedule them?

[BPry]

Not sure how you would do it with the system logs, as they aren't an option within custom reports as you've likely already found out. You could likely script something with the API to run the query and actually export the results? 

You could do the a kind of similar report simply by using the user-id logs since that is something you can actually build a Custom Report on, then you could schedule. The Query would simply be ( datasource eq vpn-client ) and you can then run a report to see which users logged in on which days. That might be enough for what you are looking for? 

[bhakti1213]

Will that report telll me the pervious logged on users with ( datasource eq vpn-client )?

[BPry]

@bhakti1213,

Yes; the user-id logs with the ( datasource eq vpn-client) will return all users who logged in during the time period you've specified. 

[bhakti1213]

Is the the only query I am suppose to put because when I run the report it does not give me that much results.  Or do I put 

 ( database eq vpn-client) and (receive_time in last-calendar-month)

aslo the user log will be trhe device user logs right?

[BPry · Accepted solution]

@bhakti1213,

So this report will really only be helpful if you are aiming to get which user logged in when. I would likely set it up so that the Culumns has the User, IP, Source Name, Device Name, Day, Count, and Source Type present (Possible Hour). Then you would control the time in which you are searching via the 'Time Frame' field when you are building the custom report. 

What the report should give you at the end of the day is essentially that user 'bpry' logged into globalprotect on Sun, Jun 24, 2018 a total of 3 times. Since you aren't looking at the actual GlobalProtect information that's all you'll be able to view. 

[bhakti1213]

Ok that is the report that I am looking for. For the Query section I should only put the query you gave me correct? And thanks for your help, greatly appericate it!!!

[bhakti1213]

One last question do you know if this report can provide x number of users per hour (concurrent)

[BPry]

@bhakti1213,

Correct, you just need the query in the earlier post (note that I modified it as I had specified the wrong thing). This report isn't able to view concurrent number of users as it isn't reading the actual GlobalProtect data. 

[bhakti1213]

Then for that do you know any way if that is possible to get that in the report, any query? This report is 95% complete just need that small thing to complete this report. Is there any way?