Some ACC graphs of Last Calendar Day are not displayed
271
Created On 03/31/25 06:25 AM - Last Modified 10/28/25 20:05 PM
Symptom
- When "Last Calendar Day" is selected as ACC Time range, only the line graphs are not displayed.
- Another graphs (treemap, horizontal bar graph, etc) and the tables of the widget are displayed.
- In the following sample, only the line graphs in User Activity widget is blank, but bytes, sessions in the same widget is displayed. The treemap in Application Usage widget is available.
Environment
- Any PAN-OS software.
- Any Firewall Platforms.
Cause
- It happens under high logging rate.
- If Last Calendar Day is selected, firewall will generate ACC from summary database. * Check out Wrong information in ACC tab compared to data collected in custom reports about summary database.
- Timetree is generated from daily traffic summary(dailytrsum) here, but line graph will be generated from 15 minutes summary data(trsum).
- This is a screenshot while it's working fine. Line graph in User Activity widget is generated in 15 minutes interval. It's from trsum.
- Therefore, if trsum at that time is purged from the firewall, the line graph will be blank.
- We can check the current retention for each database by this command. This sample indicates that the retention of trsum is less than 1 day.
admin@PA-VM> show system logdb-quota Disk usage: traffic: Logs and Indexes: 3.0G Current Retention: 1 days threat: Logs and Indexes: 680M Current Retention: 4 days system: Logs and Indexes: 159M Current Retention: 50 days config: Logs and Indexes: 258M Current Retention: 40 days alarm: Logs and Indexes: 13M Current Retention: 0 days trsum: Logs and Indexes: 1.1G Current Retention: 1 days <<---!! hourlytrsum: Logs and Indexes: 463M Current Retention: 1 days dailytrsum: Logs and Indexes: 153M Current Retention: 5 days weeklytrsum: Logs and Indexes: 154M Current Retention: 26 days
Resolution
- Increase the quota of trsum.
- Refer How to Edit the Log DB Quota Values for the Various Logs on the Firewall to edit the logdb quota.
- The last step is to upgrade the platform model.