topic SmartEvent and bandwidth report per application in Firewall & Security Management

SmartEvent and bandwidth report per application

Alex- — Sat, 31 Aug 2024 10:00:58 GMT

R81.20 Take 76 SMS, R81.20 Take 65 ClusterXL.

SmartEvent isn't my forte, but nevertheless I've been able to do some specific reporting here and there.

I'm currently looking at bandwidth reports for specific traffic patters and can't seem to get exactly what we want.

For instance, I create a simple access rule with source subnet --> destination subnet --> Remote Desktop Protocol, Accept, Log with accounting and I see the bytes in the log cards.

When I run a bandwidth report on that specific rule, either by name, source IP, rule UID, we get "No data found".

Obbjects like Office 365 and so on seem to somewhat work with variations in the intended reporting results though.

We use a chart report with Bandwidth as X and Logs/Applications Name as Y and no results.

This is disconcerting since as stated in the log card of the access rule we see traffic accounting.

We tried some built-in reports and custom made as well.

Any tips will be welcome.

Re: SmartEvent and bandwidth report per application

the_rock — Sat, 31 Aug 2024 11:08:59 GMT

If you ever do find out how to do this, please share. I had a TAC case for 2 months about it for a customer and client gave up at the end. They were asked to keep installing jumbo fixes on R81.20, but did not do anything. Plus, this was dedicated SE server. I even tested so many things in the lab, no joy.

Andy

Re: SmartEvent and bandwidth report per application

Alex- — Sat, 31 Aug 2024 11:52:21 GMT

Thanks for raising the morale. 😀

Re: SmartEvent and bandwidth report per application

the_rock — Sat, 31 Aug 2024 13:17:08 GMT

If you want me to lie, I can do that too, but not my motto in life 😂😂😂😂

Anyway, Im hopeful you will find the solution mate!

Andy

Re: SmartEvent and bandwidth report per application

Amir_Senn — Sun, 01 Sep 2024 08:43:14 GMT

Hi,

SmartEvent only indexes non-connection logs.

Does your log have "Session" enable on the log tracking?

Re: SmartEvent and bandwidth report per application

the_rock — Sun, 01 Sep 2024 23:39:09 GMT

@Alex- Let me see if I can find what was tried back then. Guy in DTAC was very good actually, but as you know, these things are not so easy when it comes to smart event.

Since Monday is a holiday, will check Tuesday.

Best,

Andy

Re: SmartEvent and bandwidth report per application

Alex- — Tue, 03 Sep 2024 06:52:03 GMT

Hi @Amir_Senn,

We checked the "per Session" in the advanced log options of the rules and we already see much more in the Access Control reporting compared to before, we can now investigate these reports further.

Thanks for pointing us in the right direction. 😀

Re: SmartEvent and bandwidth report per application

Amir_Senn — Tue, 03 Sep 2024 08:09:08 GMT

No problem, glad to help.

Re: SmartEvent and bandwidth report per application

the_rock — Tue, 03 Sep 2024 11:49:11 GMT

Definitely an amazing tip Amir.

Andy