About djr

Hi all, I am trying to produce a scheduled Top Talkers report and while I can get one working it's very rough and doesn't show much, so I wondered if anyone had done this and come up with something better? The problem is if I include source and destination in the report, even if I group by source address, it treats each source/destination pair separately, so I just see the top N conversations rather than what I would call the top talkers. What I was hoping to produce is a report where the top talker is defined as the address who generates the most traffic and then for that address, display the top N destinations (conversations), then repeat for the second biggest talker and so on. My way a big torrenter would show up at the top of the report but with relatively small conversations to destinations.  At the moment because each conversation is small, the user doesn't even appear on the report. The way I have made it work is to omit the destination so I just see traffic based on top source address.  I don't get any detail about where they are talking to but I do at least see who is passing the most traffic. Any ideas most welcome. ... View more

Has anyone else noticed this? Go to the ACC and sort it by Bytes (I believe this trick works regardless of the sort criteria, but it’s easiest to see this way). Make a note of the top three or so values Next, Click on one of these, I picked the top: web browsing. Compare the total bytes now with the values you recorded before.  About half?  Me too. For further curiosity, dismiss the web-browsing filter and see what has happened - the values are now half what they were.  If you move around in the GUI at some point they will reset to their high values, but you can halve them again the same way as before. I logged this with TAC but really couldn't understand the response.  Something about traffic summaries and dataplane/appstat data.  The best I got was "ignore the first screen, it's a problem which is logged as a feature request" Is anyone else aware of this?  Seems like a big thing to me.  Just wondering if anyone else was aware or maybe understood it better and could explain it. ... View more

I am using agentless syslog integration for user ID and it's working but for every login event I am seeing twice as many log messages received as auth success log messages and I want to know why.  Is there a way to look at the logs received by the PA? >show user server-monitor state exi         UDP Syslog Listener Service is enabled         SSL Syslog Listener Service is disabled Proxy: exi(vsys: vsys1)         Host: exi(1.2.3.4)         number of log messages                            : 16         number of auth. success messages                  : 8 ... View more

If I use the REST API to pass user ID mappings from my RADIUS servers into the firewalls, what should I do when they are in an HA pair? Because I don't necessarily know which with be the active one, should I just write to one and if that fails, swap to the other (will work if they pass user info between them) or do I have to write all updates to both simultaneously to ensure that the active one has the data? Thanks in advance Oh, while I am in here, how can I see if it is working?  With the XML API to the server user id agent, there was a log I could query, but I can't see anything similar on the device. ... View more

Hi I am seeing the process pan_summary_gen clocking up 80-100% CPU at regular intervals for a few minutes at a time.  Is this a known or should I report it? ... View more