This message can mean one of two things:
- The filter you used when generating the report did not match any data.
- There is no data in the date range you chose to report on.
If not, the data has either been purged by the data retention policy (check Settings | Data Storage | Settings), or there was a data import issue on the dates you chose to report on. Perhaps the Fastvue Reporter service was not running, or your Firewall was not sending syslog data during those dates.
Troubleshooting FiltersIf there is data shown in the Settings | Data Storage chart, then the blank report is due to an issue with the filter you specified.
Reporting on Users without AuthenticationThe most common issue we see is when reporting on users. Even though you can select a User from a picklist in Fastvue Reporter, the report will come back blank if your FortiGate has not logged any authenticated traffic for that user.
For example, when running a User Overview Report, Fastvue Reporter provides a picklist of users to report on. This list of users is built using the information imported from Active Directory. In order to find the traffic that matches the selected user, FortiGate needs to first authenticate the traffic to include the authenticated username in the syslog data it sends to Fastvue Reporter.
Without authentication, the report will come back blank. Instead, try filtering reports by IP addresses or hostnames. For more information see Understanding How Fastvue Reporter shows Users (or hostnames or IP addresses)
Reporting on Departments, Offices or Security Groups without AuthenticationFiltering reports by Departments, Offices of Security Groups also requires FortiGate to authenticate users.
Without authentication, Fastvue Reporter cannot match the log data to user objects in Active Directory, and therefore cannot filter data by Departments, Offices or Security Groups. Instead, try filtering reports by Subnets using a filter such as:
Beware of the 'AND' between Filter Criteria Rows
Instead, you should use this.
Each value in the same row is evaluated with an 'OR'.
String Matching IssuesWhen filtering Reports, many fields provide a picklist to choose from such as Productivity, Actions, and Categories. But for other fields, you need to type the value you want to filter by.
Some fields in Fastvue Reporter (such as the Site fields - see below) expect a specific string or value, and if you don't enter the exact value required, the report will come back blank.
When filtering by any of the Site fields, read the hint provided in the Value edit box for the part of the URL each field expects. For example:
This filter will never match:
Site 'Equal to' youtube.com
as 'Site' expects a sub-domain such as www.youtube.com.
Instead, you should use:
Site Domain 'Equal to' youtube.com
Or alternatively, use the 'Contains', operator:
Site 'Contains' youtube.com
Also, be careful of the dreaded typo:
Site Domain 'Equal to' yuotube.com
For more information on reporting on sites, please see Using Filters to Report on Websites with Fastvue Reporter.
If all of the above checks out, and you're still receiving blank reports, please get in touch and let us know the filter you are using (screenshots help!).