- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
02-12-2013 08:42 PM
Hi,
I have inherited responsibility for our Palo Alto 2050 and am trying to run user activity reports. However, for the past week the reports have been showing "No Data Available". The only change made I am aware of was having the policy set to only log on session end however that has since been change back. Changes were committed. The policy is aimed at capturing and allowing all...
Attached is an example report which was run for my account, though it is mostly blank and screenshots showing security policy settings.
Thanks in advance for any help; I have been trying to get this to work for a couple of hours now
02-17-2013 03:53 PM
This issue has been resolved. The user identification client on the domain controller was using an account which had been disabled.
Thanks again for the help!
02-13-2013 06:41 AM
Hi,
The policy you are hitting, does that have a URL filtering profile associated with it with actions as block or alert?
Thanks,
Syed R Hasnain
02-13-2013 06:44 AM
Hi,
To add more on the last comment, do you have relevant URL filtering logs for your ip address or source user, as the User Activity report pulls the data from the URL logs from the PAN.
Thanks,
Syed R Hasnain
02-13-2013 08:18 AM
This looks like the user is not being found. Can you try the same report with that users IP address instead of username? Then double check the spelling of both the username and domain. Thank you,
~Jamie
02-13-2013 10:15 PM
jfitz-gerald wrote:
This looks like the user is not being found. Can you try the same report with that users IP address instead of username? Then double check the spelling of both the username and domain. Thank you,
~Jamie
Thanks Jamie,
I've run the report using the IP address as suggested and get results (Thousands of pages worth). However, most of them aren't web traffic, simply internal network traffic. There are no errors in the username's used, there are reports that were previously working that aren't now where the usernames haven't been modified.
shasnain wrote:
Hi,
The policy you are hitting, does that have a URL filtering profile associated with it with actions as block or alert?
Thanks,
Syed R Hasnain
Thanks Syed,
The security policy does have a URL filtering profile attached which has almost all catorories set to Alert. I've attached a couple of screen shots with the settings incase it is any help.
shasnain wrote:
Hi,
To add more on the last comment, do you have relevant URL filtering logs for your ip address or source user, as the User Activity report pulls the data from the URL logs from the PAN.
Thanks,
Syed R Hasnain
I do see the logs under Monitor > Logs > Traffic for the same username however they seem to have stopped after the 4th of this month. I'm running a user activity report now for the last 30 days however that will have to run overnight.
Hopefully these are the logs you were referring too...
Thanks agian!
Blake
02-17-2013 03:53 PM
This issue has been resolved. The user identification client on the domain controller was using an account which had been disabled.
Thanks again for the help!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!