Panorama Defined Custom Report (Run Now, Managed Custom Report) Discrepancies

24225

Created On 09/26/18 19:16 PM - Last Modified 01/20/25 06:49 AM

Custom Reports

Reporting and Logging

PAN-OS

Panorama

Next-Generation Firewall

Symptom

A user defines a scheduled Custom Report on Panorama for Device URL log, Using the Last Calendar Month, and action (for example, block-url from Manage Custom Reports from Monitor > Manage Custom Reports).
As shown below, from the Custom Report the user selects Run Now and generates the Custom Report.
Now, From Monitor > Reports the user selects the same Custom Report defined from Manage Custom Reports.
When both reports are downloaded, both reports are very different regarding the data. Both reports were generated using the same defined Custom Report, but produce absolutely different report data.

The discrepancy of these reports are because of the data available on the disk.

Run Now Report:

Run Now on Managed Custom Reports will run the requested report on the existing URL logs on the device.
For the Time Frame of Last Calendar Month, the report will consist of available logs on the device for this time frame.
But since these are logs for Last Calendar Month for URL blocks, most of the logs for last month will most likely not be on the disk anymore and have already been over written.
This will result in a report that only consists of what is still available on the disk to produce the report.

Scheduled Custom Report:

The report for the Custom Report (under Reports) is actually a scheduled report.
Since there is a Custom Report for URL blocks scheduled for Last Calendar Month, each day of a given month, the URL blocks are added to a report file for the first of the month, to the last day of the month.
Each day data is being appended to the report file until the end of the month to get the full report of the Last Calendar Month.
When selecting this report under Custom Reports on Reports, the user is given the option to download.
This is the accurate data that has been collected for each day of the month till the end of the month, when the full report for the Last Calendar Month is generated.