Daily Category Report

[DKell]

Hi Folks,

I'm new to fortianalzer and my sql skills are poor to say the least so feel free to reply as if you are talking to a 5 year old!

Basically I have been asked to produce a daily report which lists when a user tries to access certain categories.

So far I have managed to get it working for one category (Extremist Groups) with the following:

select from_dtime(dtime) as timestamp, `user` as usr, catdesc as category, hostname as hostname from $log-traffic where catdesc='Extremist Groups' order by dtime desc

This works as I had hoped.

However, we would like to be able to add multiple categories.

I tried:

select from_dtime(dtime) as timestamp, `user` as usr, catdesc as category, hostname as hostname from $log-traffic where catdesc='Extremist Groups' or

catdesc='Weapons (Sales)' order by dtime desc

However this didn't produce any results?!  Ideally I would like to be able to produce the report daily with 4 categories included.

If you could point me in the right direction it would be appreciated.

Regards

[AtiT]

Hi, try:

SELECT from_dtime(`dtime`) AS timestamp, `user` AS usr, `catdesc` AS category, `hostname` AS hostname FROM $log WHERE `catdesc` IN ('Extremist Groups', 'Social Networking', 'News and Media') ORDER BY dtime DESC

Dataset for the Traffic log type.

[DKell]

Thanks for the quick reply I will have a look in the morning.

Cheers