Issues with User reports

[cpasquale]

We are unable to see more than 6 days of user data for USER ACTIVITY reports, URL filtering or traffic logs.  OS version 10.1.6

Any help would be most appreciative.

[PavelK]

Hello @cpasquale

overall log retention depends on Firewall model and volume of the logs.

You can confirm log retention from CLI: show system logdb-quota.

Scroll to the bottom to: "Session log usage". Here you will find current log retention.

If you have unallocated disk space, you can increase log quota from Device > Setup > Management > Logging and Reporting Setting > Session Log Storage.

If you have already allocated all available space and still this is not meeting your desired retention time, depending on volume of traffic that generates logs, there is not much you can do to extend it. The only option I can think of is to re-arrange some quota. For example, reduce allocated percentage for Threat and assign it to Traffic. Another option is to set log forwarding to external syslog server/SIEM.

Kind Regards

Pavel

[TomYoung]

Hi @cpasquale and @PavelK ,

You can also tune your logging.

1. You can turn off logs for non-critical apps such as DNS, etc.
2. You can turn off logs for non-critical zones such as guest.
3. I also like to create a universal rule to drop all Internet traffic not allowed by the firewall.  This reduces a lot of "noise" in the logs.

The important thing to remember when troubleshooting is that you may need to reenable logging for some rules.

Thanks,

Tom