icon-unified.svg
Experience Center

About the System Audit Report

The System Audit Report highlights the status of GRE tunnels, PAC files, authentication frequency, PAC file sizes, Office 365 One Click, and IP visibility. The report runs on the first of every month, and the analysis is presented on everything as of that date. If there are any present issues, the report shows recommendations on how to fix them.

Some issues might involve having no backup or updated GRE tunnels, failing to set up monitoring on the failover tunnel, and not using the ${GATEWAY} MACRO to help forward traffic to Zscaler. These issues might result in traffic inadequately being sent to the Zscaler cloud, which can lead to an internet outage. You might also run into authentication issues and other issues that impact your user experience when sending traffic to Zscaler. For example, the Microsoft-Recommended Office 365 One Click Configuration option ensures a smoother Office 365 experience by automatically exempting the required URLs so that authentication and SSL interception is performed appropriately. If this button is disabled, you might run into user experience issues.

You can view the report in the Admin Portal by going to Analytics > Internet & SaaS > Analytics > System Audit Report.

In some cases, the previous month's report will be unavailable to view. In these cases, you'll be shown the month prior to the previous month's report. For example, if you generate your report some time in September, and your August report is unavailable, you'll be shown your July report.

About the System Audit Report

The report has three main sections:

  1. High Availability Configuration
    • In this section, we aggregate your last month's internet-bound traffic sent in both the Primary or Failover tunnel, and detect whether there's any activity on the tunnel. Tunnel activity includes things like GRE Keep-alives, IPSLA, and regular traffic sent to us. The report only shows tunnels with issues and also shows whether there is missing activity on the Primary or Failover tunnel or both. Information is sorted on Failover missing, followed by Primary missing, followed by both tunnels missing.

      The following table shows the rubric used to grade this section:

      IssuesGrade
      No GRE tunnelsNo Grade
      Issues with less than 10% of all GRE tunnelsA
      Other issues between 10% and 90% of all GRE tunnelsB
      Issues with more than 90% of all GRE tunnelsC

      If you receive a grade of B or C, see Best Practices for Deploying GRE Tunnels.

      Even if the GRE tunnels are shown as zero, and you get a letter grade, it's because we are seeing traffic from that IP address. You should create a location associated with that IP address.

      Close
    • In this section, we check all PAC files to see if they use an Internet & SaaS Public Service Edge’s static FQDN name or VIP address in the return statement. The PAC files can use Global Internet & SaaS Public Service Edge IP address, Virtual Service Edge IP address, Private Service Edge IP address, or an on-premises proxy solution, and it won’t be flagged in this report.

      You can view all the static IPs of a PAC file by clicking View All next to the Static IP Addresses column. A dialog box appears listing all the static IPs. You can search for static IPs or download the list as a CSV file.

      The following table shows the rubric used to grade this section:

      IssuesGrade
      No PAC filesNo Grade
      Issues with less than 10% of all PAC filesA
      Other issues between 10% and 90% of all PAC filesB
      Issues with more than 90% of all PAC filesC

      If you receive a grade of B or C, see Best Practices for Writing PAC Files.

      Close
  2. User Experience Configuration
    • In this section, we check the authentication frequency configuration. We also check to see if authentication is enabled for any location.

      The following table shows the rubric used to grade this section:

      StatusGrade
      Authentication Disabled for all locationsNo Grade
      Configured Only OnceA
      Other (Weekly, Custom, etc.)B
      Configured Daily or Once Per SessionC
      Close
    • In this section, we check the size of all PAC files and flag files that are greater than 25 KB. Shorter PAC files are evaluated more quickly, enhancing the user experience.

      The following table shows the rubric used to grade this section:

      IssuesGrade
      No PAC filesNo Grade
      Issues with less than 10% of all PAC filesA
      Other issues between 10% and 90% of all PAC filesB
      Issues with more than 90% of all PAC filesC

      If you receive a grade of B or C, see Best Practices for Writing PAC Files.

      Close
  3. Other Configuration
    • In this section, we check to see if the Microsoft-Recommended Office 365 One Click Configuration is enabled.

      The following table shows the rubric used to grade this section:

      StatusGrade
      EnabledA
      DisabledB
      Close
    • In this section, we check the overall traffic on each GRE tunnel, and also obtain the overall internal IPs seen inside the tunnel. We then calculate the approximate number of users for that GRE tunnel. If the difference between the internal IPs and the approximate number of users is high, we flag the GRE tunnel to say that NAT is performed.

      The following table shows the rubric used to grade this section:

      IssuesGrade
      No GRE tunnelsNo Grade
      Tunnels with NAT are less than 10% of all GRE tunnelsA
      Other issues between 10% and 90% of all GRE tunnelsB
      Tunnels with NAT are more than 90% of all GRE tunnelsC

      If you receive a grade of B or C, see Best Practices for Deploying GRE Tunnels.

      Close

The overall grade for each main section is the lowest grade received in that section.

The overall grade for the report is the overall grades for High Availability Configuration and User Experience Configuration combined. It's not dependent on Other Configuration.

Related Articles
About Cybersecurity InsightsAbout Interactive ReportsAbout Industry Peer ComparisonAbout the System Audit ReportAbout the Sandbox Activity ReportScheduling the Sandbox Activity Report Weekly EmailAbout the Sandbox Files Found Malicious ReportScheduling the Sandbox Files Found Malicious Report Weekly EmailCIPA Compliance ReportAbout the Company Risk Score ReportAbout the User Risk ReportCompany Summary Report (CIO Report)Company Summary Report (CSO Report)Security Policy Audit ReportExecutive Insights ReportAbout SaaS Assets Summary ReportViewing Internet & SaaS Quarterly Business Review ReportsAbout Configuration Risk ReportAbout the Data Discovery ReportViewing Data Discovery DetailsAbout the IoT Discovery ReportAbout Discovered DevicesProviding Feedback on IoT Device ClassificationsAbout Scheduled ReportsScheduling ReportsCreating or Copying a ReportExcluding Locations in User-Related ReportsExporting and Importing ReportsPrinting ReportsAbout Endpoint DLP ReportAbout Endpoint DLP Report: IncidentsAbout the Email Security ReportAbout Email Security Report: IncidentsAbout the Gen AI Security ReportAbout the Instance Discovery ReportViewing the Resource Discovery Report