Reporting URLs and Bytes together?

[KGC]

We are trying to produce a report which summarizes the URLs visited by a specific user along with the total bytes downloaded from each URL.

It seems that the bytes are available in the Traffic log, but not the URLs; conversely, the URLs are in the URL log, but not the bytes.

Is there some way or producing reports which correlate the various logs?

Thanks!

[kalavi]

Hi,

You can send both reports at the same time but you can not merge two different reports into one.

-Khubaib 

[KGC]

Yes it seems there is not good way to produce reports which correlate the various logs on the device, which is a shame.

[DavePalo]

Hi,

I'm trying to do the same.

I'm exporting both the traffic and url logs to another device and trying to create a more comprehensive log file with both the URL and bytes fields.

Once all this info is in one log file hopefuly I will be able to do some analysis on it.

There are a number of fields you can use to reliably match up the log entries - session ID, src & dst IP, src & dst port etc.

My attempts at writing a shell script to merge the url and traffic files show promise but are pitifully slow.  I can't help feeling that there is a better way than a shell script to do this - but an even better way would be for all the info to be in one log file to start with!

Regards,

Dave

[KGC]

I can't imagine it's all that difficult to just allow the various logs to be combined into a single report query right on the device. There is potentially a lot of valuable information to be leveraged from correlating the separate logs.

I hope this is something that PAN is already working on.

[Karan_Bheda]

Has this been fixed yet. I still do not see an easy way to see the bytes.