Fortianalyzer VM- User Detailed Browsing report

[alinbuletin]

Hi,

Having trouble getting User Detailed Browsing report using a demo Fortianalyzer VM64. All other reports are working fine. I'm using Fortigates 100c (v5.2.1 build 618) and an 100d (v 5.0 build 4429) in my network.

There are logs on FortiView tab but only this report isn't generating.

Are you aware of any limitation of this report using the demo version?

Thanks in advance

[hzhao_FTNT]

Hi, there is no special limitation for User Detailed Browsing report. But this report is supposed to take long time to finish, since it will fetch up to 10,000 records, that will be several hundreds of pages in PDF.

hz

[alinbuletin]

I can understand this, however the report is done in few seconds and there is nothing inside. Like I've mentionned before I can see logs coming from both Fortigates on FortiView and I just need to prepare a report for the managers with the web browsing times for a specific user.

And another thing... is there any way to increase with one week the expiration time for this Fortianalyzer? I didn't have time to do all the testing.... specially this report .

Thanks again.

[hzhao_FTNT]

Hi,

For FOS5.2 log, this report will use webfilter logs, please double check if you can see logs in fortiview->log view->security->Web Filter. If log is OK, you also need specify a user filter for this report, please make sure you have entered correct user or IP info. By the way, multiple users have to be separated by comma.

If you still got empty report, pls test dataset web-Detailed-Website-Browsing-Log in reports->Advanced->Dataset 

If you are familiar with SQL, you can add user filter to sql queries and test if you can see data output. 

If dataset test OK, but still got empty report, please debug under CLI and post debug message here.

dia debug enable

dia debug application sqlplugind 8

exe sql-report run root 10012

Change root to the ADOM name you want to run this report.

Sorry, I have no idea about extending trial period.

hz

[alinbuletin]

I did all that, got results when testing but still no data in the report.

In the attachment I put debug log.

Thanks for your help

[hzhao_FTNT]

It looks like you specified "all" in user filter. Wildcard is not supported here, you must specify one or more existing user or ip in this filter.  Maybe you can run Web Usage report, then check "Top 20 Most Active Users" and get correct user/ip info there.

[alinbuletin]

I've tried already with different users and got nothing.

[hzhao_FTNT]

That's weird. What's your FAZ version? We have no issue with this report recently. I may need remote access to your FAZ to identify the problem. Could you require a customer ticket and post the number here?  Or you can send your faz access info to my email hzhao@fortinet.com if you need immediate assistant.

[alinbuletin]

I can open even an tech support ticket... my old Fortianalyzer  is still covered?

Which type of ticket then?

Thanks,

[alinbuletin]

Curtoemr ticket number 1254586