Users with no traffic - Web Insights

Is there a better way to find out which users have no web traffic for the custom time period?
It is time consuming to run logs with the random URL Search keyword and ALL users to then filter the data in the exported csv file.

Just to confirm, you want to find users who were once active but have not been active during a certain time period? This is best done at the SIEM with more powerful query language. The mobile admin portal can show you the time that a device last connected, but it’s still one by one to search.

Hi,
what about using the “active user” export from the “Web Insights” (not from log) and then compare it with the UserDB with some excel-magic, like “highlight duplicate values” and select all “not highlighted” usernames? Those should be users with not traffic.

Or filter with “traffic forwarding == Zscaler Client connector”, some other ZCC specific attributes (device model etc) to make the result smaller and then use the excel magic?
That is what I suggest my customer, besides the user export from Client Connector Portal and then check “last seen” col.
Both is not optimal.

Best regards
Andreas

We have users that show update zapp policy and have current “last seen” but no traffic is passed through zscaler tunnel, nothing is being filtered. These users will not show any traffic if I run a web action report for all users then in excel I have to compare to all users…
Then, since zscaler is not filtering IPv6, we had some users with IPv6 enabled so that traffic is not getting filtered but other is so these users show traffic in logs therefore impossible to catch them.

Thanks for the suggestions.
I think you are the first person from Zscaler that understands what I am trying to achieve.
Unfortunately for me, it looks like there is no easier way to accomplish what I am trying to than what i am already doing.

Thank you :slight_smile:
I am not from Zscaler, I am from British Telecom / BT (Germany). One of my customers asked me the same question last week as we currently do the ZCC roll-out on iOS devices.
I opened a ticket and support answered that there is already an enhancement request, but there is no ETA…
Currently it seems that the only more or less reliable option is the log export (with as much filters as possible to reduce the size) and then compare it either with UserDB or Client Connector Portal export via some excel magic.

Best regards
Andreas

Hi,
it is enhancement request ER-4201. You can open a ticket and get “pinned to this ER”.

Best regards
Andreas