How to Run a Report for Previous Logged in GlobalProtect Users

How to Run a Report for Previous Logged in GlobalProtect Users

Created On 09/26/18 13:48 PM - Last Modified 10/31/20 00:51 AM


This document describes how to create and export a report for previous logged in GlobalProtect users within the last one month.

  • PAN-OS 7.1, 8.1 and 9.0
  • Palo Alto Firewall.
  • GlobalProtect configured.

  • PAN-OS does not have a predefined or custom report capability to create a report for previously logged in GlobalProtect users.


As shown below, previously logged in GlobalProtect users can be seen in real time under Network > GlobalProtect > Gateways. Select Remote Users followed by Previous Users:


In order to create an exportable report for previous users:

  1. Go to Monitor > Logs > System and filter the logs using the following string:
    (eventid eq globalprotectportal-config-succ) and (receive_time in last-calendar-month)
Note: The output in the picture below shows the results of previously logged GP users using the string above.
  1. Click on the Excel icon on the top right-hand side of the page and select Download file


owner: kadak

Additional Information
For additional information regarding our reporting features available within PAN-OS, please refer to the following documentation:

  • Print
  • Copy Link

Choose Language