Reports

Reports help you analyze traffic and threats and in regulatory compliance.

For example, you can view a report that includes all web server protection activities taken by the firewall, such as blocked web server requests and identified viruses.

Use reports to identify threats, manage usage, and increase security.

To view a report, select a group from the Show list. Some selections allow you to further refine the data in the report. You can also specify a date range for the report.
To refresh the report data, click Generate.
To download the report data, click any of the available download formats.
To create a bookmark for the report, click Bookmark.
To schedule a report to be emailed at specified intervals, click Schedule.
To filter the results, click Filter and specify the criteria.
To specify configuration options for reports, click Show report settings.

The following selections result in a report that shows application traffic for a specified date range.

Note

XGS 87(w) and XGS 88(w) don't support on-appliance reporting.

Reports disk space

When you upgrade the firmware from SFOS 20.0 and earlier to SFOS 21.0 and later, the firewall stores the reports before and after the upgrade in separate databases.

The following is the behavior when you generate a report after the firmware upgrade:

When you only select the upgrade date as the date range, the firewall gives you the option to select a database. To get the reports for the entire day, you must click the options Data before migration and Data after migration individually.

Example

The upgrade date is August 7, 2024 and you select it as the date range:

The following pop-up appears:
When you include the upgrade date in the date range, the firewall tells you to select a date range before or after the upgrade date.

Example

The upgrade date is March 28, 2024 and you include the upgrade date in the date range:

The following pop-up appears:

Warning

If you upgrade to SFOS 21.0 and later versions and then roll back to an earlier version, you'll lose all reports generated since the upgrade, even when you upgrade to 21.0 again.

For example, you're on SFOS 20.0 (A). You now upgrade to version 21.0 (B). If you roll back to version 20.0 (C), you lose the reports generated when you were on version 21.0 (between B and C). After you upgrade to a newer build of version 21.0 (D), you can see your reports before D, but any reports you created between B and C won't be available.

The firewall stores reports in the /var folder. The space limits for the folder are as follows:

Default limit at which a warning is shown: 70 percent.
You can change the default to a value from the following range: 50 to 75 percent. See .
Limit at which reporting stops: 80 percent. You can't change this value.

To lower disk usage, see Disk space for logs and reports.

Note

If reporting stops due to disk space issue, you must bring disk usage below the warning limit (default: 70 percent). The firewall then starts generating reports again. For 20.0 GA, see Report summarization stops.

Notifications

The firewall notifies you when the reports disk usage reaches the lower or higher threshold.

Control Center

A warning appears when the disk usage reaches the lower threshold.

An alert appears when the disk usage reaches the higher threshold.

The warning and alert disappear when the disk usage goes below the lower threshold.

Email and SNMP notifications

The firewall can send email and SNMP notifications when the disk usage reaches the higher threshold. They're turned off by default.

To turn on email and SNMP notifications, do as follows:

Go to System services > Notification list.
Click the Disk/Memory drop-down.
Select the email or SNMP checkbox or both for Reports disk usage exceeded threshold.
Click Save.

Log viewer

The firewall generates log viewer messages when the disk usage reaches the lower threshold, the higher threshold, or goes below the lower threshold.

More resources