User activity reports on Panorama

[thierry_demeire]

We've just got a new Panorama and Palo Alto implementation done.

Reviewing the reporting options I noticed that a "User Activity Report" can not be requested from the Panorama server.

It can be requested from the devices themselves.

My issue with running the report from the devices is that we have an active/Passive setup, so I need to run the report on both devices and bring them togehter. Knowing the report is in PDF-format, this is a hell of a job.

Seeing that Panorama is THE reporting engine, I was wondering if something needs to be tuned or enabled on Panorama to be able to run the user activity report from the Panorama server, which could them combine logs from both devices.

Any insights are more than welcome.

Cheers

[James]

Hi There,

You can filter reports on Panorama by user to achieve something similar to the UAR - this is the current solution.  Other than changing the context in Panorama and running the report directly from the device.

The "Canned" UAR reporting function will be added to the next major release of Panorama due out begining of 2011.

Best Regards

James

[ariodique]

Regarding UAR, is there a way to run this report based on User IP? Will this be added to Panorama early 2011? Not every report on my end can be ran based on a username because not every machine is on ldap or ad. Esp. the Mac and Linux boxes..

[James]

Hi There,

The answer to both your questions is yes.  You can try the IP report today and the Panorama UAR functionality is currently in beta.

Thanks

James

[CWillms]

OK - so how do you pull a user report based on IP, we have a similar situation to ariodique's. I keep getting "no data found" - clearly I'm  doing something wrong. I need a report that goes back several months but I can't seem to determine how far back my data goes before it "rolls off". We also use Panorama for managing and reporting.