Skip to main content
RedMt
RedMt
New Member
April 10, 2017
Question

Session timeout report

  • April 10, 2017
  • 1 reply
  • 5768 views

Hi everyone,

 

I'm using a FortiAnalyzer on 5.2.10. I need a report I can schedule to email out that shows all session timeouts for the previous day showing source ip, destination ip, and application or destination port. It would be nice if I could see the session duration, source user, and filter by application / destination port, but those are not necessary.

 

I know enough about the FAZ to make new reports and layouts, and I poke around in charts some, but I'm clueless when it comes to creating datasets. I've not been able to find a pre-configured dataset to support that kind of report, and I'm hoping that someone on here might help me with that. 

 

Thanks for your time.

1 reply

RedMt
RedMtAuthor
New Member
April 27, 2017

Friendly bump :)

hzhao_FTNT
Staff
hzhao_FTNT
Staff
May 4, 2017

could you post a sample log with session timeout?

hzhao_FTNT
Staff
hzhao_FTNT
Staff
May 4, 2017

try below dataset

log type: traffic

select from_itime(itime) as timestamp, srcip, coalesce(nullifna(`user`), nullifna(`unauthuser`)) as user_src, dstip, dstport, app from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and action='timeout' group by itime, srcip, user_src, dstip, dstport, app order by itime desc

Then create a table chart based on this dataset and add it into a report.

For "the previous day", set report  time period to "Yesterday", for filter of application / destination port, you can specify in report setting with app "equal to" and dstport "equal to"

 

regards,

hz

Terms & ConditionsAccessibility statement