Hi all,
We have some custom SmartReporter reports setup, we've used them for years now. We have one which shows the past 24-hours Anti-Virus and Anti-Bot events, it's essentially built with the following columns:
Report Category: Threat Prevention
- Protection Name
- Source
- Destination
- Blade
etc... And the filter is to equal Anti-Virus OR Anti-Bot blade. A very simple report.
Typically this has always worked, we get emailed the report every day, and it's a nice summary of events. We can glance at it and easily see what types of attacks occurred, what IP's were involved, severity, resource/FQDNs etc..
Recently its stopped populating, the logs are still there, but the reporter isn't pulling them. Strangely when going on "last 24-hours" on the report, there is nothing. But change to "Past 7 days" and it populates some details, but events are still missing.
It's really inconsistent, even building a report/widget from scratch with very simple filters (E.g. show me anti-virus & anti-bot blades events) it's not populating correctly.
Our SmartReporter is a separate VM to our management server.
We patched the SmartReporter to the latest R81.10 JHF will no joy.
Checking the antivirus/bot logs IN SmartReporter shows the logs/events are there, so the reporter has them. But for whatever reason its not putting them into the Reports via the widget, even when expanding the filters to be very open.
Is there any tshoot steps we might be able to perform to try and remedy this?
Thanks!
