Generate SecureClient stats for a single user

[lammbo]

Need a little help here... Not quite sure that I'm doing anything wrong but I am confused by this.

Today, after 6 months of Eventia usage, I got my first request for VPN usage for a single user - Woo hoo! Here comes Eventia - NOT!

Here's my setup:
SmartCenter/SVMonitor/Secondary Log server - R60-HFA_04 (Win2k3/SP1 - HA server is same)
Eventia Suite/Primary Log server - R63 (SPLAT)
Gateways are all active/passive clusters (4 SPLAT, 6 Nokia - should be irrelevant for this)

What I tried in Reporter:
Predefined --> VPN --> SecureClient Users Activity
Filter Tab --> User (abbreviated) --> UserXy (selecting a single user only)


Results:
Suck... The filter does not seem to be working properly. Any report I run shows all users activity. Abandoned that report as useless.


What I tried next on a new report:
Predefined --> VPN --> SecureClient Users Activity
Then I went to the content tab and unchecked everything except "List of All SecureClient Users Login". I edited that and used the same User (abbreviated) filter. The logic here was that I was severely limiting the report to just that section and just that single user for this month. Still shows all users - which, BTW, with all users showing up, I don't even get 1 day of data in the report before it truncates at 1000 lines. Again - worthless.

Can anyone either tell me what I'm doing wrong or confirm that they get similar results using same filters and this is maybe a bug?

[lammbo]

In the absence of peer interest/help, I've opened a case with my support vendor so hopefully, answers to follow soon. In the meantime, if anyone else could just try to run a report on a single user to confirm or refute my belief that this is a bug, please do so.

[RayPesek]

I don't have ER at this job but I did at my last one and what you're trying to do is definitely possible. Are you by any chance authenticating with Check Point certificates?

If so, you cannot pick the user name <sigh>. You have to go into SmartView Dashboard and copy their CN= string to the clipboard. Then you go back to ER and enter that CN= string as the user to filter on.

It's not a bug, it's a feature. :-(

Ray

[lammbo]

Have been working with CP support - this is where I am now:

Even though "user (abbreviated)" is fully populated by my database, "user (long)" must be used for filtering. The username must be manually entered in this filter, as it is not pre-populated by any data. The username is not actually the full user's name, it must still match the short username.
Example: JohnDo instead of John Doe

It is still unclear whether this is a bug or not. I get the impression that CP support was able to duplicate results in their lab. I assume that their own lab server was not an upgrade from the R63 (Early Adopter version) as mine is - that would rule out that my issue was caused by that or DB corruption anyway. I'm pretty sure it must be a bug.

[lammbo]

Checkpoint has confirmed this is a bug. They are keeping my case open while developing a hotfix. I will post on this again when the fix is available.