How to Run a Report for Previous Logged in GlobalProtect Users

How to Run a Report for Previous Logged in GlobalProtect Users

76013
Created On 09/26/18 13:48 PM - Last Modified 10/31/20 00:51 AM


Symptom

This document describes how to create and export a report for previous logged in GlobalProtect users within the last one month.



Environment
  • PAN-OS 7.1, 8.1 and 9.0
  • Palo Alto Firewall.
  • GlobalProtect configured.


Cause
  • PAN-OS does not have a predefined or custom report capability to create a report for previously logged in GlobalProtect users.


Resolution

As shown below, previously logged in GlobalProtect users can be seen in real time under Network > GlobalProtect > Gateways. Select Remote Users followed by Previous Users:

 

In order to create an exportable report for previous users:

  1. Go to Monitor > Logs > System and filter the logs using the following string:
    (eventid eq globalprotectportal-config-succ) and (receive_time in last-calendar-month)
Note: The output in the picture below shows the results of previously logged GP users using the string above.
 
 
  1. Click on the Excel icon on the top right-hand side of the page and select Download file

 

owner: kadak



Additional Information
For additional information regarding our reporting features available within PAN-OS, please refer to the following documentation:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/view-and-manage-reports/custom-reports


Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClplCAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language