How to Run a Report for Previous Logged in GlobalProtect Users (PAN-OS 7.1-9.0)
116572
Created On 09/26/18 13:48 PM - Last Modified 08/24/22 00:37 AM
Symptom
This document describes how to create and export a report for previous logged in GlobalProtect users within the last one month.
Environment
- PAN-OS 7.1, 8.1 and 9.0
- Palo Alto Firewall.
- GlobalProtect configured.
Cause
- PAN-OS (PAN-OS 7.1-9.0) does not have a predefined or custom report capability to create a report for previously logged in GlobalProtect users.
Resolution
As shown below, previously logged in GlobalProtect users can be seen in real time under Network > GlobalProtect > Gateways. Select Remote Users followed by Previous Users:
In order to create an exportable report for previous users:
- Go to Monitor > Logs > System and filter the logs using the following string:
(eventid eq globalprotectportal-config-succ) and (receive_time in last-calendar-month)
Note: The output in the picture below shows the results of previously logged GP users using the string above.
- Click on the Excel icon on the top right-hand side of the page and select Download file
Additional Information
For additional information regarding our reporting features available within PAN-OS, please refer to the following documentation:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/view-and-manage-reports/custom-reports