User reports don't show hardly any of the traffic users are generating

Question

If we parse the raw logs from the Sophos UTM, we can build our own reports that seem to show all the URL's that our users are visiting. However, if we try to use any of the native reporting tools they results only show a fraction of the sites visited. Why the disparity? What is the purpose of the built in reports? 
 All I want to do is select a User/Computer/IP address and show all the sites they have visited in the past Day/Week/Month. 
 I have tried the Logging/Reporting > Web Protection reports and Logging/Reporting > View Log Files > Search Log Files > Web Filtering. The latter tends to show more, but not all. 
 Am I missing something required to do this simple reporting on users? Does reporting require a third party product? 
 Sophos proudly touts the number of built in reports, but I find that the quantity is irrelevant if the data is questionable or not easily extracted.

BAlfson · Accepted Answer

Tim, it's hard to work without examples of what you're seeing... 
 In 'Reporting Settings', you can select the detail retained in Reporting. 
 If you have a firewall rule like 'Internal (Network) -> Web Surfing -> Internet : Allow', accesses can occur that don't transit the Proxy. This can happen if Web Filtering is in Standard mode, but the individual client isn't configured correctly. It can happen with HTTPS if the Proxy is in Transparent but is not inspecting HTTPS traffic. It also can happen in Transparent if someone uses anything other than port 80/443 and there is a firewall rule allowing the traffic. 
 Cheers - Bob

TimBoggs · Answer

There was a firewall rule like 'Internal (Network) -> Web Surfing -> Internet : Allow', so I disabled it. So I guess this indicates that the proxy component does not rely on the firewall for access. 
 Web Filtering was in Standard mode with 'Block access on authentication failure' disabled. 
 
 Created a new web filter profile scoped to my computer to test. No change when blocking enabled. Checked policies and found that a custom Filter Action > Additional Options > Activity Logging has "Log accessed pages" disabled. After I enable that more traffic started showing up in the logs. 
 Basically this was dropping all the authenticated traffic from the Web Filter log, which is apparently used for reporting. Going to let it run tomorrow with all users and see how it reports.