A discussion about reports.

The interface report.

A report added because someone thought it would nice. Almost meaningless, needs to be graph of the preceding reporting period so XG managers get a view of the internal and external network utilisation.

The CPU graph.

falls into the same category, you can't really tell if you have an issue during the day or when?

The users report.

Eventually it must report much less than a days connection because the connection time in the daily report is always more than 1 day.

I have created additional daily reports

1/. blocked websites

while this report has lots of data you cannot identify which user/ip address has had the bad site. I have not been able to find away of relating user/ip address to a bad download/site.

One of my reports showed access to a proxy which I consider unsafe, but does not show who or what accessed the site. The list goes on and on....

Hi Luk,

thank you lferrara for your support, at times I think I am a lone voice and must be doing something wrong because there are not many complaints about the reports.

Rfcat_vk,

this is not properly true. Many System Admins do not care about reporting. They are happy with what the appliance produces (Firewall, IPS,  SIEM, DB, etc..) but only few of them compare the reports with other data to see if they are correct.

XG is reporting false email counting, live connection usage...I did not have the time to compare web traffic.

So you are not alone! Maybe iView is more congruent in terms of number.

Regards

Yes, iview might be, but not all people who use XG have access to iview and if the UTM can get it correct, why can't the much pushed upgrade get it correct?

https://community.sophos.com/products/xg-firewall/f/sophos-xg-firewall-general-discussion/92935/large-amount-of-gateway-traffic-not-appearing-in-reports

See my post - some apparent error in total traffic reported compared to the gateway numbers (which match ISP).

Thanks Dean. I red that post yesterday.

To all users:

"Please post all the links or possible issue here, so we can raise up the Sophos Attention and have a unique threat where to find reports issue". Reports are important. They can decide more aspects inside a Company.

Thanks to all in advance!

Is Onedrive a possible source of this reporting error? I've been watching logs and reports this morning with Onedrive doing some large sync downloads in the background but I can't identify the Onedrive traffic in XG Firewall.

As soon as I pause sync the bandwidth chart drops almost to zero but the traffic doesn't seem to be logged and counted in totals.

Note that my total Onedrive storage is less than the really large amounts of traffic I reported in an earlier post.

I also have an issue with times on some of the charts.

This screenshot was taken at about 8:10AM, it looks like the live report chart is ahead by 1 hour. We are not in daylight savings at the moment (Australia) and I am using the standard NTP server for the firewall.

Hi Dean,

which version of XG are you running? Also how long since your XG was powered off eg before daylight savings ended. I have found some settings do not update correctly unless the XG is actually powered off.

I have checked my reports and found them to be on time, but at the moment I swap between UTM and XG about once week as updates are released.

latest firmware and probably powered on for a couple of months, maybe after end of daylight savings but i can power off to test.

Why is nothing being done here, reports are still bad, nothing has changed.  this is from 2017 and now its 2019 almost looks like Sophos does not care about its customer.  

Why is nothing being done here, reports are still bad, nothing has changed.  this is from 2017 and now its 2019 almost looks like Sophos does not care about its customer.