User Activity Reports - No Data Available

Reply
Highlighted
Not applicable

User Activity Reports - No Data Available

Hi,

I have inherited responsibility for our Palo Alto 2050 and am trying to run user activity reports. However, for the past week the reports have been showing "No Data Available". The only change made I am aware of was having the policy set to only log on session end however that has since been change back. Changes were committed. The policy is aimed at capturing and allowing all...

Attached is an example report which was run for my account, though it is mostly blank and screenshots showing security policy settings.

Thanks in advance for any help; I have been trying to get this to work for a couple of hours now :smileysad:


Accepted Solutions
Highlighted
Not applicable

Re: User Activity Reports - No Data Available

This issue has been resolved. The user identification client on the domain controller was using an account which had been disabled.

Thanks again for the help!

View solution in original post


All Replies
Highlighted
L4 Transporter

Re: User Activity Reports - No Data Available

Hi,

The policy you are hitting, does that have a URL filtering profile associated with it with actions as block or alert?

Thanks,

Syed R Hasnain

Highlighted
L4 Transporter

Re: User Activity Reports - No Data Available

Hi,

To add more on the last comment, do you have relevant URL filtering logs for your ip address or source user, as the User Activity report pulls the data from the URL logs from the PAN.

Thanks,

Syed R Hasnain

Highlighted
Palo Alto Networks Guru

Re: User Activity Reports - No Data Available

This looks like the user is not being found.  Can you try the same report with that users IP address instead of username?  Then double check the spelling of both the username and domain.  Thank you,

~Jamie

Highlighted
Not applicable

Re: User Activity Reports - No Data Available

jfitz-gerald wrote:

This looks like the user is not being found.  Can you try the same report with that users IP address instead of username?  Then double check the spelling of both the username and domain.  Thank you,

~Jamie

Thanks Jamie,
I've run the report using the IP address as suggested and get results (Thousands of pages worth). However, most of them aren't web traffic, simply internal network traffic. There are no errors in the username's used, there are reports that were previously working that aren't now where the usernames haven't been modified.

shasnain wrote:

Hi,

The policy you are hitting, does that have a URL filtering profile associated with it with actions as block or alert?

Thanks,

Syed R Hasnain

Thanks Syed,
The security policy does have a URL filtering profile attached which has almost all catorories set to Alert. I've attached a couple of screen shots with the settings incase it is any help.

URL_Filtering.PNG

URL_Filtering_Profile.PNG

shasnain wrote:

Hi,

To add more on the last comment, do you have relevant URL filtering logs for your ip address or source user, as the User Activity report pulls the data from the URL logs from the PAN.

Thanks,

Syed R Hasnain

I do see the logs under Monitor > Logs > Traffic for the same username however they seem to have stopped after the 4th of this month. I'm running a user activity report now for the last 30 days however that will have to run overnight.

Hopefully these are the logs you were referring too...

User_Logs.PNG

Thanks agian!

Blake

Highlighted
Not applicable

Re: User Activity Reports - No Data Available

This issue has been resolved. The user identification client on the domain controller was using an account which had been disabled.

Thanks again for the help!

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!