DotW: Application Usage Report

This week's Discussion of the Week, (DotW), is about reports. We discuss some limitations, but also some options.

The discussion that caught my eye was:

https://live.paloaltonetworks.com/t5/General-Topics/Application-Usage-Report/td-p/110915

Community member Brandon_Wertz  posted a question about the Application Usage Report. His biggest issue was the fact that the reports are limited to 500 rows, which cannot be increased with the current versions of PAN-OS.

To help others who are using reports, but running into issues exporting the data in CSV (comma-separated value) format, the default value for CSV is 65536 rows. The problem arises when the reports are exported, because hardly any of the data is exported, thus making the CSV format to be imported into Excel or any other spreadsheet almost useless.

The good news is that this value can be increased from 65536 rows to 1048576 rows.

The Log Export and Reporting screen showing the default value of 65536 rows, but this can be increased to 1048576 rows.

To increase this value, inside the WebGUI, go to Device > Setup > Management > Logging and Reporting Settings. Click the sprocket (edit) in the upper right of that window, and the settings screen will appear, then click on the Log Export and Reporting tab.

Inside there, you will see the Max Rows in CSV Export. Change that value from 65536 to 1048576 rows.

Don't forget to commit the configuration to allow the new settings to take effect.

This way, when you need to export the data in CSV format, you will still be limited to the number of rows in the report, but the new limit is now over a million rows.

If still performing these steps, you are  not getting the information you are needing from the reports, you can think about narrowing down the source or destination, or even service in order to get more granular and detailed information in the reports.

I hope this helps in your reporting.

Stay secure!

Joe Delio