I have inherited responsibility for our Palo Alto 2050 and am trying to run user activity reports. However, for the past week the reports have been showing "No Data Available". The only change made I am aware of was having the policy set to only log on session end however that has since been change back. Changes were committed. The policy is aimed at capturing and allowing all...
Attached is an example report which was run for my account, though it is mostly blank and screenshots showing security policy settings.
Thanks in advance for any help; I have been trying to get this to work for a couple of hours now
This looks like the user is not being found. Can you try the same report with that users IP address instead of username? Then double check the spelling of both the username and domain. Thank you,
I've run the report using the IP address as suggested and get results (Thousands of pages worth). However, most of them aren't web traffic, simply internal network traffic. There are no errors in the username's used, there are reports that were previously working that aren't now where the usernames haven't been modified.
The policy you are hitting, does that have a URL filtering profile associated with it with actions as block or alert?
Syed R Hasnain
The security policy does have a URL filtering profile attached which has almost all catorories set to Alert. I've attached a couple of screen shots with the settings incase it is any help.
To add more on the last comment, do you have relevant URL filtering logs for your ip address or source user, as the User Activity report pulls the data from the URL logs from the PAN.
Syed R Hasnain
I do see the logs under Monitor > Logs > Traffic for the same username however they seem to have stopped after the 4th of this month. I'm running a user activity report now for the last 30 days however that will have to run overnight.
Hopefully these are the logs you were referring too...
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!