A discussion about reports.

The interface report.

A report added because someone thought it would nice. Almost meaningless, needs to be graph of the preceding reporting period so XG managers get a view of the internal and external network utilisation.

The CPU graph.

falls into the same category, you can't really tell if you have an issue during the day or when?

The users report.

Eventually it must report much less than a days connection because the connection time in the daily report is always more than 1 day.

I have created additional daily reports

1/. blocked websites

while this report has lots of data you cannot identify which user/ip address has had the bad site. I have not been able to find away of relating user/ip address to a bad download/site.

One of my reports showed access to a proxy which I consider unsafe, but does not show who or what accessed the site. The list goes on and on....

This is a good topic. 

My opinion is that the reports have a lot of potential, but are fairly useless right now.  I suspect that the reports were designed by people who don't really know what "real" admin's need/want to know.  Lots of room for improvement.

So far didn't get many bites on the subject.

Let us now look at the active reports.

Current Activiities

This report should be very useful, except it isn't. It shows every clientless user active (passing data) or not.

Wireless -> wireless client report

The IP addresses in this report are different to the active connections report. My ipad has 165, which shows in the wireless report, but in the active connections it shows as 164

And the daily reports are hard to follow as a result, debugging the firewall rules is even more difficult.

So far didn't get many bites on the subject.

Let us now look at the active reports.

Current Activiities

This report should be very useful, except it isn't. It shows every clientless user active (passing data) or not.

Wireless -> wireless client report

The IP addresses in this report are different to the active connections report. My ipad has 165, which shows in the wireless report, but in the active connections it shows as 164

And the daily reports are hard to follow as a result, debugging the firewall rules is even more difficult.

The memory allocation issue has been fixed, but the report still fails basic maths.

QA on XG releases is not very good.

Reporting is still shows false numbers.

Aditya Patel, sachingurung and AlanT you should have a look at reporting section. What rfcat_vk has discovered on a number of threads is true. XG is reporting false numbers inside the reports.

Make sure you "re-design" them. Reports are one of the key used inside Organization for forensics analysis, policy and standards, auditing and ....the list is long.

Customers will not be happy at all [:@] if they discover that reports are providing false information.

I am not sure this is a bug but a more "by design" that should be addressed in short time.

We are looking forward to hearing from you!

Regards

Hi Luk,

thank you lferrara for your support, at times I think I am a lone voice and must be doing something wrong because there are not many complaints about the reports.

Rfcat_vk,

this is not properly true. Many System Admins do not care about reporting. They are happy with what the appliance produces (Firewall, IPS,  SIEM, DB, etc..) but only few of them compare the reports with other data to see if they are correct.

XG is reporting false email counting, live connection usage...I did not have the time to compare web traffic.

So you are not alone! Maybe iView is more congruent in terms of number.

Regards

Yes, iview might be, but not all people who use XG have access to iview and if the UTM can get it correct, why can't the much pushed upgrade get it correct?

https://community.sophos.com/products/xg-firewall/f/sophos-xg-firewall-general-discussion/92935/large-amount-of-gateway-traffic-not-appearing-in-reports

See my post - some apparent error in total traffic reported compared to the gateway numbers (which match ISP).

Thanks Dean. I red that post yesterday.

To all users:

"Please post all the links or possible issue here, so we can raise up the Sophos Attention and have a unique threat where to find reports issue". Reports are important. They can decide more aspects inside a Company.

Thanks to all in advance!

Is Onedrive a possible source of this reporting error? I've been watching logs and reports this morning with Onedrive doing some large sync downloads in the background but I can't identify the Onedrive traffic in XG Firewall.

As soon as I pause sync the bandwidth chart drops almost to zero but the traffic doesn't seem to be logged and counted in totals.

Note that my total Onedrive storage is less than the really large amounts of traffic I reported in an earlier post.

I also have an issue with times on some of the charts.

This screenshot was taken at about 8:10AM, it looks like the live report chart is ahead by 1 hour. We are not in daylight savings at the moment (Australia) and I am using the standard NTP server for the firewall.

Hi Dean,

which version of XG are you running? Also how long since your XG was powered off eg before daylight savings ended. I have found some settings do not update correctly unless the XG is actually powered off.

I have checked my reports and found them to be on time, but at the moment I swap between UTM and XG about once week as updates are released.