Panorama/ Report Creation...

[CWillms]

...suitable for presentation. I guess I don't understand what I'm seeing or I don't understand what I should expect from Panorama. Quickly: I have 2 PA-2020's logging to a single Panorama instance where I attempt to create "consolidated" reports. Ver 3.1.4 for all componants.

1.) I generate a raw report using filters within Monitor/URL Filtering for a specific username and export the CSV. Lots of good info, so far so good.

2.) I generate a report within Manage Custom Reports for the same specific username and the key criteria I'm looking for from the URL Log database and there is almost nothing in it. Despite accounting for "Repeat Count" only 3 or 4 URL's are displayed when the raw report shows hundreds of different URL's.

Is there any decent documentation on how to create URL activity reports? This is extremely frustrating. We replaced Websense with this but at least I could create decent, presentable reports with Websense.

I have to be doing something wrong???

[skrall · Accepted solution]

What is it you are trying to view?

Are there any canned reports that give you almost what you want?

Can you tell me the paramaters you have selected for your report?

Database = (URL Log)

Colums:  (Repeat count, URLs, others?)

Top X:    (5, 10, 25, 50, 100, 250, 500)

Sort by:   (none or repeat count)

Group by:

X Groups: (5, 10 , 25 , 50)

Filters?

Thanks,

Steve Krall

[CWillms]

Thanks - that was it. I missed the part to select the top - X. I had it at the default which produced very little.

[gmoerschel]

When URL reports are generated via Panorama, does Panorama query each firewall individually for its data in order to build the output? I take it that URL logs are streamed to Panorama in contrast to traffic data.

[skrall]

URL logging information is classified as "Low" or "Informational" severity. These need  to be enabled and sent to Panorama for Panorama to create any meaningful URL reports. URL information is sent to the Panorama at regular intervals just like traffic data. Only the ACC screens query the devices in real time.

Steve Krall