User Activity Report

Showing results for 
Search instead for 
Did you mean: 

User Activity Report

Not applicable

Hey folks,

Just installed my first PAN firewall - after running an eval unit for about a month.  Loving it so far, but still learning...

First question for this board - hope it's not a dumb one.

We're running 3.0.9 and pan-agent and that seems to be working fine.  In Traffic log and URL Filtering log user ID seems to be working fine. The problem I'm running into is that I can't seem to get the User Activity Report to work at all.  The logs report the username as:


So I tried that first in the "user" field of the report, but I also tried DOMAIN\username and just plain username.

Any troubleshooting tips or suggestions here?

Many thanks,




L4 Transporter

Hi Grant,

I noticed that when I copy and paste the username in through certain browsers a trailing space would be included.  Any extra spaces will keep the report from being properly generated.  A small thing but it has bitten me in the past. Smiley Happy

Also, I have heard of some minor PAN Agent issues with 3.0.9 PANOS but this was revolving around policy creation, not logging or reporting.  If the above suggestion doesn't work, I wonder if downgrading to 3.0.8 might help.



Nope, that's not it.  I'm typing it in, not copy and paste.

We are using version 3.1.0 of the agent, could that be the problem?  Seems unlikely since User ID in general is working fine.

If the usernames are showing up in the logs, then it seems it should be working.  First, try upgrading to 3.1.2.  Also try generating the report via IP address instead of username and see if that works.  If neither of those help, you may need to contact support.



The problem here was that I was choosing "Last Calendar Day" for the time frame, while the user had no activity.  Once I switched that to "Last 12 Hours", it worked fine.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!