SmartEvent and bandwidth report per application

[Alex-]

R81.20 Take 76 SMS, R81.20 Take 65 ClusterXL.

SmartEvent isn't my forte, but nevertheless I've been able to do some specific reporting here and there.

I'm currently looking at bandwidth reports for specific traffic patters and can't seem to get exactly what we want.

For instance, I create a simple access rule with source subnet --> destination subnet --> Remote Desktop Protocol, Accept, Log with accounting and I see the bytes in the log cards.

When I run a bandwidth report on that specific rule, either by name, source IP, rule UID, we get "No data found".

Obbjects like Office 365 and so on seem to somewhat work with variations in the intended reporting results though.

We use a chart report with Bandwidth as X and Logs/Applications Name as Y and no results.

This is disconcerting since as stated in the log card of the access rule we see traffic accounting.

We tried some built-in reports and custom made as well.

Any tips will be welcome.

[the_rock]

If you ever do find out how to do this, please share. I had a TAC case for 2 months about it for a customer and client gave up at the end. They were asked to keep installing jumbo fixes on R81.20, but did not do anything. Plus, this was dedicated SE server. I even tested so many things in the lab, no joy.

Andy

[Alex-]

Thanks for raising the morale. 😀

[the_rock]

If you want me to lie, I can do that too, but not my motto in life 😂😂😂😂

Anyway, Im hopeful you will find the solution mate!

Andy

[the_rock]

@Alex- Let me see if I can find what was tried back then. Guy in DTAC was very good actually, but as you know, these things are not so easy when it comes to smart event.

Since Monday is a holiday, will check Tuesday.

Best,

Andy

[Amir_Senn · Accepted solution]

Hi,

SmartEvent only indexes non-connection logs.

Does your log have "Session" enable on the log tracking?

[Alex-]

Hi @Amir_Senn,

We checked the "per Session" in the advanced log options of the rules and we already see much more in the Access Control reporting compared to before, we can now investigate these reports further.

Thanks for pointing us in the right direction. 😀

[Amir_Senn]

No problem, glad to help.

[the_rock]

Definitely an amazing tip Amir.

Andy