topic Re: Too few data on SmartView Reports in General Topics

Too few data on SmartView Reports

SantosJoao — Wed, 21 Aug 2024 19:15:15 GMT

Hello All,

I was generating a report for one of our domains, and I could see that the report returned too few data compared to the logs on the same timespan. In comparison, for another domain that we also have, the report showed all the expected data. Have you already faced something like this? I tried to generate the logs both on SmartView and SmartConsole and the outcome was the same, removed any filters but still the behavior continues. This is a multidomain environment, and these two domains I mentioned are managed by the same Manager.

Attached are some screenshots showing the issue. They were all filtered for the last 24 hours and on that example, the host with the Brazil's flag on the report returned 1 log but on the logs view returned much more

Re: Too few data on SmartView Reports

PhoneBoy — Wed, 21 Aug 2024 23:55:27 GMT

Version/JHF of management?
What is the nature of the rules related to the traffic you're trying to run reports on?
Specifically, are they rules that involve Applications (versus Services)?

Re: Too few data on SmartView Reports

SantosJoao — Thu, 22 Aug 2024 14:18:23 GMT

Hello PhoneBoy,

The version is R81.10 JHF take 150. The report in this case is the Network Activity standard report that came with the box, it's being used to get details from the firewall blade and firewall rules

Re: Too few data on SmartView Reports

the_rock — Thu, 22 Aug 2024 14:40:08 GMT

I found in the lab, since I run dedicated smart event, there were way more options when I upgraded to R81.20 originally. Now, its on jumbo 76, so definitely something to think about.

If there is specific report you want me to test, please let me know.

Andy

Re: Too few data on SmartView Reports

PhoneBoy — Thu, 22 Aug 2024 17:04:37 GMT

Firewall Blade meaning only simple TCP/UDP services in your rulebase, correct?
Activity with these rules are not indexed by SmartEvent by default.
Ensure that firewall sessions are enabled on the various rules by right-clicking on the Track field and enabling the appropriate checkbox.

Re: Too few data on SmartView Reports

SantosJoao — Thu, 22 Aug 2024 18:41:27 GMT

Hello Guys,

Thanks for the reply.

That's right, the report that I'm trying to generate are using the rule based on TCP/UDP ports

I've checked here, most of the rules are with the log option enabled. I could see that some of the options you have checked I don't have, however I could see on the report that there are more data for blocked packets than for accepted, and the deny rules are using the same log options as the accept rules.

Re: Too few data on SmartView Reports

the_rock — Thu, 22 Aug 2024 18:57:28 GMT

You need to check "accounting" to see it all.

Andy

Re: Too few data on SmartView Reports

SantosJoao — Wed, 04 Sep 2024 18:33:51 GMT

Hello the_rock

Sorry for the long time without reply, The folks that manage these firewalls are applying the accounting option. I will post here later if it worked.

Re: Too few data on SmartView Reports

the_rock — Wed, 04 Sep 2024 18:36:24 GMT

No problem!