FortiAnalyzer 7.4.3 User Detailed Browsing Log report not returning all results for a user

[cjackson_ncl]

Hello,

Has anyone come across issues with the User Detailed Browsing Log report not returning the expected number of web results for a user.

For example, when looking the the webfilter log over a period of 30 days for one user, it returns over 3000 results, yet the User Detailed Browsing Log report for the same period only returns 206 results.

Another example is another user in the webfilter log over a period of 30 days will return nearly 20000 results, but just over 3000 in the User Detailed Browsing Log for the same period.

It's far to inconsistent to be a limitation on the number of results being returned, so was wondering if anyone else had, or has, the same problem.

Regards,

Chris

[Anthony_E]

Hello Chris,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Debbie_FTNT]

Hey cjackson,

my first guess would be that the underlying database queries for the detailed browsing log vs the webfilter log differ - there might be additional filters in the detailed browsing report (like only including logs with a destination hostname, or a specific webfilter action).

Are you using the inbuilt charts/reports, or did you modify them?

Are you comfortable with SQL? If yes, you can check details as follows:

-> go into the Detailed Browsing Report, into Layout

-> select 'edit' on the chart, and note the name

-> go to Chart Library, edit the chart, and note the dataset name

-> go to Datasets, find the dataset, and view it

-> check the 'where $filter and [...]' clause; $filter is a placeholder for the chart/report filters, such as timerange, devices, VDOM, and anything following after would be inbuilt filters. Those would restrict what logs count for the dataset (and thus chart/report) and could explain the difference.

Cheers,

Debbie

[cjackson_ncl]

Thank you Debbie,

Yes it is the inbuilt report and I have had mixed results with it over the years with different firmware versions. I will do as you suggested and check the SQL syntax within the dataset. Thanks again for your suggestion.