Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/index.html?contextId=reports

Reports

Reports help you analyze traffic and threats and in regulatory compliance.

For example, you can view a report that includes all web server protection activities taken by the firewall, such as blocked web server requests and identified viruses.

To generate report data, select Log firewall traffic in each firewall rule.

Use reports to identify threats, manage usage, and increase security.

  • To view a report, select a group from the Show list. Some selections allow you to further refine the data in the report. You can also specify a date range for the report.
  • To refresh the report data, click Generate.
  • To download the report data, click any of the available download formats.
  • To create a bookmark for the report, click Bookmark.
  • To schedule a report to be emailed at specified intervals, click Schedule.
  • To filter the results, click Filter Filter button. and specify the criteria.
  • To specify configuration options for reports, click Show report settings.

The following selections result in a report that shows application traffic for a specified date range.

Select the criteria for reports.

Select the date range.

Note

XG 86, XG 86w, XGS 87, and XGS 87w don't support on-appliance reporting.

Reports disk

The firewall stores reports in the /var partition. The default lower threshold for disk usage is 80 percent. You can change it to between 60 and 85 percent. The higher threshold is 90 percent.

In SFOS 19.5 MR4 and later, the default lower threshold for disk usage is 70 percent. You can change it to between 50 and 75 percent. The higher threshold is 80 percent. See report-disk-usage.

Note

The firewall can't generate new reports if the disk usage reaches the higher threshold. We recommend you decrease the disk usage below the lower threshold to make sure the firewall generates reports. See Report summarization stops.

Notifications

The firewall notifies you when the reports disk usage reaches the lower or higher threshold.

Email and SNMP notifications

The firewall can send email and SNMP notifications when the disk usage reaches the higher threshold. They're turned off by default.

To turn on email and SNMP notifications, do as follows:

  1. Go to System services > Notification list.
  2. Click the Disk/Memory drop-down.
  3. Select the email or SNMP checkbox or both for Reports disk usage exceeded threshold.
  4. Click Save.

Log viewer

The firewall generates log viewer messages when the disk usage reaches the lower threshold, the higher threshold, or goes below the lower threshold.

The following are example logs in SFOS 19.5 MR4 and later:

Log viewer lower threshold.

Log viewer higher threshold.

Log viewer higher to lower threshold.

More resources