User Activity Reports - No Data Available

[assist]

Hi,

I have inherited responsibility for our Palo Alto 2050 and am trying to run user activity reports. However, for the past week the reports have been showing "No Data Available". The only change made I am aware of was having the policy set to only log on session end however that has since been change back. Changes were committed. The policy is aimed at capturing and allowing all...

Attached is an example report which was run for my account, though it is mostly blank and screenshots showing security policy settings.

Thanks in advance for any help; I have been trying to get this to work for a couple of hours now

[shasnain]

Hi,

The policy you are hitting, does that have a URL filtering profile associated with it with actions as block or alert?

Thanks,

Syed R Hasnain

[shasnain]

Hi,

To add more on the last comment, do you have relevant URL filtering logs for your ip address or source user, as the User Activity report pulls the data from the URL logs from the PAN.

Thanks,

Syed R Hasnain

[Jamiefitzgerald]

This looks like the user is not being found.  Can you try the same report with that users IP address instead of username?  Then double check the spelling of both the username and domain.  Thank you,

~Jamie

[assist]

jfitz-gerald wrote:

This looks like the user is not being found.  Can you try the same report with that users IP address instead of username?  Then double check the spelling of both the username and domain.  Thank you,
~Jamie

Thanks Jamie,
I've run the report using the IP address as suggested and get results (Thousands of pages worth). However, most of them aren't web traffic, simply internal network traffic. There are no errors in the username's used, there are reports that were previously working that aren't now where the usernames haven't been modified.

shasnain wrote:

Hi,

The policy you are hitting, does that have a URL filtering profile associated with it with actions as block or alert?

Thanks,

Syed R Hasnain

Thanks Syed,
The security policy does have a URL filtering profile attached which has almost all catorories set to Alert. I've attached a couple of screen shots with the settings incase it is any help.

shasnain wrote:

Hi,

To add more on the last comment, do you have relevant URL filtering logs for your ip address or source user, as the User Activity report pulls the data from the URL logs from the PAN.

Thanks,

Syed R Hasnain

I do see the logs under Monitor > Logs > Traffic for the same username however they seem to have stopped after the 4th of this month. I'm running a user activity report now for the last 30 days however that will have to run overnight.

Hopefully these are the logs you were referring too...

Thanks agian!

Blake

[assist · Accepted solution]

This issue has been resolved. The user identification client on the domain controller was using an account which had been disabled.

Thanks again for the help!