User-ID Statistics

[mmcastr]

We have a cenario where the Firewall control the Internet access from users in the local network and we control these access with URL profiles and security policies.
We identify the user session with USER-ID Agent installed on Windows AD Servers.
I'd like to count how many users the Firewall identify per day in the Internet Access.

How can I get these kind of statistic?
Is there a way to extract this data from the PA?

Regards,
Marcelo Castro

[Remo]

---

@mmcastr wrote:

Is there a way to extract this data from the PA?

---

Yes, over the API, but you probably need to write a little script (or do it manually, but I would not recommend that) that pulls every hour or so the IP-User mappings from the firewall and creates a list with only the unique usernames.

Or with a custom report where you only add sourceuser and maybe sessions to the shown columns. This will generate a report that show the sessions per user.

[Mick_Ball]

Edited...

if you are forwarding logs to syslog then...

cat paloalto.log|grep 'userdomain\\'|sed 's/.*userdomain\\//'|sed 's/ [0-9].*//'|sort|uniq|wc-l

if not, then API as per @Remo.

[mmcastr]

I did something like you suggested to get the data from logs.

Thanks for the tip.